Security
Built to read, not to move
Zeno's most important safety property is what it can't do. It has no way to move money, make a payment or reach your bank. It holds your money picture and works out a forecast from it. Everything else is done by you, or by your assistant with your approval.
What Zeno can and can't do
- No money movement. No tool transfers money, pays a bill or places a trade, and none ever will.
- No bank credentials. Zeno doesn't connect to banks. If your bank is connected in your assistant, your assistant copies posted transactions and balances into Zeno when you ask. Zeno never receives bank usernames, passwords, or account or routing numbers.
- Nothing silent. What an assistant infers is stored as a proposal, labeled with its source, until you confirm it. Changing your adopted Plan needs a reason in your words.
Access
- Your account: email and password through our sign-in service. Passwords are stored only as salted hashes. During the pilot, sign-up is by invitation only.
- Assistants: each assistant gets its own access token, limited to your household. A token can be view only. We store only a SHA-256 hash of it, so even we can't read it back. Tokens show when each was last used, and revoking one takes effect on its next request.
- Separation: every request is checked against the household its token or session belongs to. One household can't see another's data.
Where data lives
- The app and its PostgreSQL database run on servers we operate in Hetzner's US East data center (Ashburn, Virginia). This site is served by Cloudflare.
- All traffic uses TLS (HTTPS). The app and the API are separate services, and the database isn't reachable from the internet.
- We keep operational logs (time, IP address, request path and result) to run and secure the service. We don't log the contents of what your assistant sends.
AI and your data
We don't train AI models, and we don't let anyone train them on your data. Your conversation happens in your assistant, under its provider's terms. Zeno sees only the tool calls your assistant makes.
Reporting a problem
Email security@zenonest.com. We'll acknowledge it within two business days. If there's ever an incident involving your data, we'll tell you, and we'll notify the platforms we connect through as their terms require.