Security & Trust Centre

ZeroLapse is a multi-tenant B2B compliance SaaS for New Zealand businesses. Our primary security objective is tenant isolation: one organisation must not be able to access another organisation’s records or evidence. This security overview does not change ZeroLapse’s product role: ZeroLapse is a tracking, reminder, evidence and workflow platform, not a regulator, certification body, licensing authority, legal adviser or guarantee that a customer is compliant.

• Application: Next.js hosted on Vercel, configured for the Sydney region.
• Database, authentication and private storage: Supabase, configured in Sydney, Australia.
• Payments: Stripe. ZeroLapse does not store full card details.
• Transactional email: Resend.
• Error monitoring: Sentry.
• DNS/security services: Cloudflare.
• Business communications and administration: Microsoft 365.

• Every tenant table is scoped by organisation_id and protected by database row-level security.
• Organisation identity is derived from the authenticated session through server-side application context rather than trusted client-supplied organisation identifiers.
• Admin, Manager and Staff roles restrict available actions.
• Staff change proposals are subject to database-enforced ownership rules and manager approval/decline workflow.
• Evidence is stored in private storage and served through authenticated access paths with organisation-scoped storage controls.
• A cross-tenant data leak is treated as the highest-severity product security failure.

• Product mutations are designed to create audit events recording actor, action, entity type, entity identifier and change details.
• Approve and decline actions are included in audit continuity requirements.
• Compliance/expiry status is computed rather than stored as an editable status field.
• Pending proposals do not alter computed compliance status until approved.
• Destructive operations are designed to confirm database writes before related storage deletion.
• Migration lineage is required to match the live production database before dependent code is released.

The service uses provider-managed encryption in transit and at rest for supported services. Customer evidence is not intended to be publicly exposed. Authorised operator access to Customer Data is limited to legitimate support, maintenance, security, legal or operational purposes.

ZeroLapse does not publish a guaranteed backup retention period, recovery-point objective or recovery-time objective. Customers should retain independent copies of business-critical or regulatory records. Any stronger continuity commitment must be agreed in writing and backed by verified production capability.

ZeroLapse uses error monitoring and risk-based QA. Security-sensitive changes follow documented reproduction, focused remediation and verification. Release checks cover tenant isolation, authentication boundaries, audit continuity and private storage where relevant. Test coverage and counts change as the product develops, so current assurance evidence is available on request rather than presented here as a permanent release claim.

Primary application and database infrastructure is configured in Sydney, Australia. Some providers may use global support or processing locations. Current key providers are Supabase, Vercel, Stripe, Resend, Sentry, Cloudflare and Microsoft 365. The Privacy Policy and DPA explain overseas processing in more detail.

Suspected security or privacy events are assessed, contained, investigated and remediated according to severity. Where the Privacy Act 2020 requires notification because a privacy breach has caused or is likely to cause serious harm, ZeroLapse will notify the Privacy Commissioner and affected individuals as soon as practicable, subject to any applicable exception.

Send vulnerability reports to hello@zerolapse.co.nz with “Security vulnerability” in the subject line. Include the affected feature, reproducible steps, likely impact and safe supporting material. Do not access, alter, retain or disclose customer data; do not use credential attacks, social engineering, denial of service or destructive testing; and allow a reasonable opportunity for investigation before public disclosure.

• ZeroLapse does not claim ISO 27001 certification.
• ZeroLapse does not claim SOC 2 attestation.
• ZeroLapse does not claim an independent penetration-test certification unless and until one is completed and current.
• ZeroLapse does not offer a general public uptime SLA, RPO or RTO unless separately agreed.
• Security claims are intended to describe operating architecture and controls, not to guarantee that incidents cannot occur.

• Use unique credentials and protect devices and email accounts used for authentication.
• Apply least privilege and promptly remove departed personnel.
• Keep compliance records accurate and maintain independent deadline controls.
• Minimise sensitive uploads and ensure lawful authority for workforce information.
• Export records needed for continuity and regulatory purposes.
• Report suspected compromise or cross-tenant exposure promptly.

Security, privacy and trust enquiries: hello@zerolapse.co.nz
Website: https://zerolapse.co.nz
Last reviewed: 13 September 2026

This document should be reviewed after material architecture, provider, region, security-control or assurance changes.