Security
Effective: October 2026 · Self-assessment — not a certified audit
Self-assessment — not a certified audit. This is a structured self-assessment performed by the Zenlo team against recognized public security standards. It is NOT a certified or independent third-party audit. We publish it openly as part of our transparency commitment, and will commission an independent audit before enterprise due diligence.
Why we publish this
Zenlo processes biomarker data submitted by business clients. We trade marketing gloss for transparency — we publish our security posture openly, including the gaps. This page is that self-assessment.
The standards we assess against
Three layers, three frameworks:
Application & code layer — OWASP ASVS 5.0
~350 requirements across 17 chapters for secure application design. No official certification exists; verification is by self-assessment and penetration testing. We target Level 1, Level 2 where feasible.
Infrastructure / data layer — Supabase Production + hardening checklist
Supabase is SOC 2 Type 2 at the platform level. The customer is responsible for Row Level Security (RLS), SSL enforcement, Point-in-Time Recovery, network restrictions, MFA, service-role key handling, and a Business Associate Agreement where applicable.
Processing layer
Our AI processing runs under a Business Associate Agreement with zero-data-retention.
Compliance instruments
Factual status — gaps documented openly, not hidden.
- Anthropic BAA — Signed. Fully signed under Zenlo LLC; Zero Data Retention active.
- Zero Data Retention (ZDR) — Active. AI provider does not retain submitted data or use it for training.
- Supabase BAA — Not yet in place. Requires Supabase Team Plan; deferred until enterprise due diligence — documented as an open gap.
- Vercel BAA — To confirm. Status under review.
Assessment areas (first cycle — 2026-05-22)
- Database posture (RLS, policies) — Performed. RLS enabled on all tables; data isolated; no permissive policies; minor findings (dead duplicate RLS policies, redundant grants) tracked.
- Application code review (OWASP ASVS 5.0) — Performed. 0 Critical, 5 High, 6 Medium. No hardcoded secrets, no auth backdoor; findings tracked (framework CVEs, middleware auth, security headers).
- Platform settings (MFA, SSL, PITR, network) — Performed. Deployment protection on, HSTS present; findings tracked (enable MFA, SSL enforcement, network restrictions, PITR).
- Remediation & re-test — Pending. Prioritized remediation items identified; fixes and re-test to follow.
What this report does NOT claim
- Not a certified security audit.
- Not a declaration of HIPAA or regulatory compliance.
- Not a third-party or independent audit — self-assessed by the Zenlo team.
- Does not guarantee data safety; it documents controls implemented and gaps identified.
- Supabase BAA is not yet in place — an open gap documented above.