Security
Zira holds the record of who acts for whom. This page is our security spec: what we protect, how, and how to reach us.
Four rules every part of Zira is built to follow.
Agents, people and our own staff get only the access they need, for only as long as they need it.
Every call is authenticated and checked. Nothing is trusted because of where it comes from.
Every decision is written to an append-only log that can’t be quietly changed.
If a check can’t complete, the answer is “held”, never “allowed”. [Placeholder]
Certifications are placeholders until confirmed.
Available on request under NDA. [Placeholder: how to request them]
We keep what verification needs. Nothing more.
Agent identities, principals, scopes and verification records.
The content of the requests your agents make.
In transit and at rest. [Placeholder: standards]
[Regions]
Verification records [X days]. Audit logs [X days].
On request, within [X days].
Append-only and tamper-evident. Export to your own systems. [Placeholder: formats]
Revoke an agent everywhere within [X seconds]. Revoked passports fail every check from then on.
Boring, on purpose. Details are placeholders.
[Cloud provider] in [regions].
Signing keys held in [HSM or KMS], rotated [how often].
Private networking between services. [Placeholder]
[Frequency], restore-tested [how often].
Staff access by SSO with hardware keys, logged and reviewed. [Placeholder]
Found a vulnerability? Tell us first.
[security@zira.example]
Placeholder address. [PGP key fingerprint]
We won’t pursue good-faith research that follows our policy. [Placeholder: safe-harbour terms]
We acknowledge reports within [X] working days. Read the full policy
Privacy policy How we handle personal data.
Subprocessors list Who helps us run Zira, and where. [List placeholder]