Security

How Zero AI protects your data, keys, and identity.

🔐Zero-Knowledge Commitment

Your API keys are encrypted with AES-256-GCM before storage. Zero AI staff cannot read, access, or transmit your keys. Decryption occurs only client-side in your browser. We never see your keys — this is enforced by design, not policy.

BYOK Encryption Architecture

Zero-Knowledge

The Bring Your Own Keys (BYOK) vault uses client-side encryption exclusively:

Algorithm: AES-256-GCM (authenticated encryption)
Key derivation: PBKDF2-SHA256, 100,000 iterations, unique 16-byte salt per vault
IV: 12-byte random per encryption operation — never reused
Scope: Encryption and decryption occur in your browser using the Web Crypto API
What we store: Only the ciphertext — mathematically unreadable without your passphrase
What we never see: Your plaintext keys, your passphrase, the derived encryption key

Authentication

JWT + bcrypt

Passwords hashed with bcrypt (cost factor 12) — never stored in plaintext
Authentication via JWT (HS256), 7-day expiry, signed with a secret never exposed in client code
Session tokens stored in httpOnly cookies — inaccessible to JavaScript, XSS-resistant
CSRF protection on all state-mutation endpoints
Failed login attempts rate-limited at 5 per minute per IP

Infrastructure

Cloudflare Edge

All traffic served over HTTPS with TLS 1.3 minimum
Hosted on Cloudflare Pages with global edge runtime — no origin server to attack
DDoS mitigation via Cloudflare’s network layer
Secrets management via Cloudflare environment variables — never in source code
Database (Upstash Redis) encrypted at rest and in transit

HTTP Security Headers

X-Frame-Options: DENY

X-Content-Type-Options: nosniff

Referrer-Policy: strict-origin-when-cross-origin

Permissions-Policy: camera=(), microphone=(), geolocation=()

Strict-Transport-Security: max-age=63072000; includeSubDomains

API Security

Every API route validates the JWT before processing
Request bodies validated with Zod schemas — no type confusion attacks
Rate limiting per user per endpoint (60–2000 req/min depending on tier)
API keys in route handlers loaded from Cloudflare env vars at runtime — never in client bundles
All edge routes run in isolated Workers — no shared process state between users

BYOK Provider Testing

When you click “Test Key” in the vault, your key is sent directly from your browser to the provider’s API (e.g., api.openai.com). Zero AI’s servers are not in the data path. The test result (pass/fail) is returned; the key itself is never logged or stored by our infrastructure.

Responsible Disclosure

If you discover a security vulnerability in Zero AI, please report it responsibly:

Email: kingh.hanz@gmail.com
Subject: Security Disclosure — Zero AI
Include: description, reproduction steps, potential impact

We acknowledge all reports within 24 hours and aim to patch critical issues within 72 hours. We do not pursue legal action against good-faith researchers.