Skip to main content

Technical and Organizational Measures

At a Glance​

AreaDetails
Data Location100% Germany — Azure Germany West Central · Supabase AWS Frankfurt
EncryptionTLS 1.3 in transit · AES-256 at rest
AuthenticationJWT + MFA · Project-level RBAC · Row-Level Security
AI ModelsOpenAI, Anthropic, Mistral — EU-hosted model options available
On-PremiseFull on-premise deployment on request
ComplianceGDPR · EU AI Act · SOC 2 controls in place (audit planned)
Security TestingContinuous dependency & vulnerability monitoring · Static code analysis
Availability24/7 uptime monitoring · Public status page with per-service uptime
Endpoint ProtectionMicrosoft Defender for Endpoint (anti-malware, EDR, intrusion detection) on all Azure servers

Data Residency & Sovereignty​

All customer data is stored exclusively within Germany — no data leaves the EU:

  • Application metadata (accounts, audit logs): Supabase, Frankfurt
  • Customer data (uploaded tables, query results, data synced from connected sources): PostgreSQL cluster, Azure Germany West Central

In the standard managed setup, data from connected source systems is synced into the PostgreSQL cluster in Germany and queried there.

On-Premise & Data Sovereignty Options​

Full on-premise deployment — For customers with stricter data sovereignty or air-gap requirements, ZeitMind can be deployed entirely within your own infrastructure, including the AI model layer, so that no customer data leaves your environment. Available for enterprise clients on request; requires an Enterprise license.

1. Hosting and Network Security​

1.1 Azure Virtual Network (VNet) Deployment​

ZeitMind production services operate within a dedicated, firewalled Azure VNet in Germany West Central (Zone 1). The environment hosts:

  • The ZeitMind agent backend and web application servers.
  • A multi-tenant, hosted PostgreSQL service with strong, auto-generated per-tenant credentials and isolated databases.
  • All compute and storage resources protected with encryption in transit and at rest (Azure-managed disk encryption).

1.2 Restricted Administrative Access​

Access to production systems is strictly controlled in accordance with the principle of least privilege:

  • Only a small set of authorized ZeitMind infrastructure and platform engineers may access production systems.
  • Access requires a personal, authenticated VPN connection using Tailscale or WireGuard.
  • Routing rules, ACLs, and engineer permissions are reviewed on a recurring schedule and adjusted based on role, project involvement, and operational necessity.
  • All access events are logged, monitored, and subject to audit.
  • No administrative ports are exposed to the internet on production servers: SSH and database access run exclusively over the private Tailscale network. Publicly, production servers accept only web traffic (ports 80/443) and Tailscale's encrypted WireGuard traffic. Database servers accept no public inbound traffic at all.
  • Automated deployments follow the same path: the CI/CD pipeline joins the Tailscale network for each deployment instead of using publicly reachable SSH.

1.3 Customer Connectivity (On-Premise Systems)​

For customers with on-premise data sources, ZeitMind offers two connectivity options:

  • Connector - a Docker container run inside the customer network. It opens no listening ports and communicates to the ZeitMind driver over TLS 1.3 (WebSocket on port 443). No inbound firewall rules are required. It forwards traffic only; no ZeitMind driver code runs on it, and the customer's own firewall governs which systems it can reach.
  • Site-to-site VPN - typically IKEv2 with PSK, between the customer network and the ZeitMind Azure VNet.

Either connection is used exclusively for secure data ingestion and controlled agent access.

1.4 Endpoint Protection & Intrusion Detection​

All ZeitMind servers in Azure are protected by Microsoft Defender for Servers (Plan 2), which deploys Microsoft Defender for Endpoint to every virtual machine:

  • Endpoint detection and response (EDR): behavioral monitoring of processes, files, and network activity on every server to detect intrusions and attacker techniques.
  • Anti-malware for customer files: files stored on our application servers are scanned for viruses, ransomware, and other malicious software every hour, and detected threats are quarantined automatically.
  • Security alerts: threats are raised in Microsoft Defender for Cloud and emailed to the ZeitMind security team immediately.
  • Vulnerability management: Microsoft Defender Vulnerability Management assesses the installed software on every server against known vulnerabilities, complemented by daily agentless disk scans on application servers.

2. Authentication, Permissions & Segregation​

2.1 User Authentication​

  • Supabase Auth with bcrypt password hashing
  • Short-lived JWT tokens, auto-refreshed
  • Multi-factor authentication (MFA) enforced for all ZeitMind staff; available for customer accounts
  • SAML-based Single Sign-On (SSO) for enterprise customers — integrate with your corporate identity provider (Google Workspace, Microsoft Entra ID, Okta, and other SAML 2.0-compliant IdPs)

SAML Single Sign-On (SSO)​

For enterprise customers, ZeitMind supports SAML 2.0-based Single Sign-On, enabling centralized authentication through your corporate identity provider.

Supported Identity Providers:

  • Google Workspace
  • Microsoft Entra ID (formerly Azure AD)
  • Okta
  • Any SAML 2.0-compliant IdP

Benefits:

  • Centralized access control — manage ZeitMind access through your existing IdP
  • Simplified onboarding/offboarding — user lifecycle managed in one place
  • Enhanced security — leverage your organization's authentication policies, including MFA enforcement
  • Audit trail — authentication events logged in both ZeitMind and your IdP

Implementation: SSO is configured per organization. Contact your ZeitMind account manager or support@zeit-ai.com to set up SAML SSO for your team.

2.2 Project Isolation​

  • Each customer project receives a dedicated database with unique, auto-generated credentials
  • No shared database connections between projects
  • Row-Level Security (RLS) in Supabase prevents cross-tenant data access at the database layer

2.3 Role-Based Access Control (RBAC)​

ZeitMind grants roles (Viewer, Proposer, Editor, Manager) to members and groups on the project, folders or single resources, enforced in the database as well as the application layer, with row-level security filtering which rows a member sees. Per-user feature flags govern access to advanced functions.

For the full role and permission model, including inheritance and row-level security, see Roles and Permissions.

When a user instructs an agent to access data, the agent acts on behalf of the authenticated user, obtaining scoped credentials aligned with that user's permissions.

3. Security Testing & Patch Management​

3.1 Patch Management​

  • Operating system and runtime patches are applied on a regular schedule.
  • Critical security patches (CVE score ≥ 9.0) are treated as P0 incidents and applied within 24 hours.
  • Dependency updates are monitored continuously and applied proactively.

3.2 Vulnerability Management​

  • Automated dependency scanning is integrated into the CI/CD pipeline.
  • Supply-chain integrity checks on all third-party packages.
  • Server vulnerability assessment on every VM via Microsoft Defender Vulnerability Management (see 1.4).

3.3 Secure Development Lifecycle (SDLC)​

  • Peer code reviews required for all production changes.
  • All changes go through pull requests; direct pushes, force pushes, and deletion of the main branch are blocked.
  • Enforced CI/CD with automated testing and static code analysis: type checking, linting, and the test suite run on every push.
  • Every pull request is deployed to an isolated preview environment that runs against demo data, never customer data, so reviewers can verify changes in a running system before merge.
  • Production deployments are fully automated from the main branch; database schema changes ship as versioned migrations that are applied in the same pipeline.
  • Dependabot keeps CI actions and container base images up to date; npm security advisories are raised automatically.
  • No plaintext secrets in code or configuration — 1Password with op run for runtime secret injection.

3.4 Responsible Disclosure & Bug Bounties​

Security researchers and customers can report suspected vulnerabilities to security@zeit-ai.com.

Reports are triaged by the engineering team and, where confirmed, remediated through the patch management and incident response processes described above. We pay a bounty for confirmed vulnerabilities, assessed case by case according to severity and impact.

4. AI Model Handling​

ZeitMind supports multiple LLM providers and is designed to minimize data exposure to external AI systems.

4.1 Supported Providers​

  • OpenAI (GPT models)
  • Anthropic (Claude models, via the Anthropic API or EU-hosted on Google Vertex AI)
  • Mistral AI (EU-headquartered, EU-hosted infrastructure)
  • Custom or self-hosted model endpoints available on request

4.2 EU-Hosted LLM Options​

For customers requiring that AI model calls do not leave the EU, ZeitMind can serve Claude models from Google Vertex AI's EU multi-region endpoint. Further options are Mistral AI, Azure OpenAI EU regions, or self-hosted open-source models running on ZeitMind infrastructure within the Azure Germany region.

4.3 Data Minimization​

  • AI models primarily receive schema metadata (table names, column names, data types).
  • In some cases, minimal data previews (small row samples) are sent to enable self-checking of generated queries.
  • AI models never receive full customer datasets.
  • All AI provider relationships are governed by data processing agreements.

4.4 Model Training Policies​

All supported AI providers are configured to prevent customer data from being used for model training. For a detailed per-provider assessment — including contractual basis, configuration screenshots, and any noted caveats — see LLM Training Policies.

5. Compliance​

5.1 GDPR​

ZeitMind is designed for GDPR compliance:

  • Data residency: All data stored in Germany (EU) — no data leaves EU data centers.
  • Data Processing Agreement (DPA): Provided to all customers; clearly defines processor–controller roles, sub-processor disclosure, and approval processes.
  • Right to deletion: Customer data is fully deleted on request.
  • Data portability: Data export available in standard formats.
  • Access controls: Role-based permissions and full audit trails support GDPR accountability requirements.

5.2 EU AI Act​

ZeitMind's AI-assisted features are built in accordance with the EU AI Act:

  • Transparency: Users are informed when AI-generated content or recommendations are presented.
  • Human oversight: All AI-generated queries and transformations require explicit user review and execution — no autonomous actions.
  • Risk management: AI outputs are treated as suggestions, not decisions.
  • Audit trail: AI interactions are logged for accountability and review.

5.3 SOC 2 & ISO 27001​

  • SOC 2 Type II: Controls in place; formal audit planned.
  • ISO 27001: Preparation underway (information security management framework).
  • Continuous compliance monitoring: Azure Policy audits our Azure environment against the ISO 27001 and SOC 2 Type 2 control sets, with results tracked in Microsoft Defender for Cloud.

6. Data Handling​

6.1 Customer Data Ingestion​

Customers may upload structured files (e.g., XLSX, CSV) through the frontend. Uploaded files are processed in-memory; no raw upload files are persisted.

Where data access is provided via secure network links, the user's assigned credentials are used to authenticate and authorize operations.

6.2 Encryption and Persistence Controls​

All customer data — both in the Azure VNet and Supabase environments — is protected via:

  • In transit: TLS 1.3 for all web traffic; SSL for database connections; VPN encryption for live data source tunnels.
  • At rest: Azure disk encryption (AES-256); PostgreSQL tablespace encryption available.

7. Logging & Backup​

7.1 What is Logged​

  • All API requests (Supabase request logs)
  • Database queries (PostgreSQL audit extension)
  • User actions and AI interactions (application audit trail)
  • Infrastructure events, errors, and authentication events

7.2 Backup & Recovery​

  • Daily automated backups of all databases
  • Point-in-time recovery (PITR) for PostgreSQL
  • Recovery Time Objective (RTO): 2 hours
  • Recovery Point Objective (RPO): 24 hours

7.3 Availability Monitoring & Status Page​

ZeitMind's availability is monitored 24/7 by UptimeRobot. Current status and historical uptime of each service are published on our public status page:

  • ZeitMind frontend and ZeitMind backend: content checks against the live application
  • PostgreSQL primary: up and continuously archiving its write-ahead log
  • PostgreSQL replica: streaming replication to the standby is healthy
  • PostgreSQL backups: scheduled backups (pgBackRest) completed successfully

Outages trigger immediate Slack and email alerts to the engineering team and are handled according to the incident response times in the IT Architecture Overview.

8. Organizational Controls​

8.1 Credential & Secret Management​

  • All secrets stored in 1Password encrypted vaults under strict need-to-know policies.
  • Project vault access is limited to engineers actively assigned to that customer account.
  • Infrastructure credentials are restricted to dedicated platform engineers.
  • MFA enforced for all internal systems and all employees.

8.2 Personnel Security​

  • Access rights reviewed on a recurring schedule and revoked promptly on role change or offboarding.
  • Administrative access to production systems is restricted to a small set of platform engineers and is subject to continuous audit.

For a technical deep-dive into infrastructure, data flows, and system architecture, see the IT Architecture Overview.