Security

Security is foundational to ZiplineOS, not an afterthought. Your business data is hosted in Australia, encrypted in transit and at rest, and isolated to your organisation alone — backed by an independently audited security program.

Australian data residency

Your data never leaves Australia. All customer data is stored and processed in Google Cloud's Sydney region — we never move it offshore for storage or backup.

Encryption

Encrypted in transit and at rest. Every connection is served over TLS (HTTPS), and data is encrypted at rest with Google-managed AES-256 across our databases, file storage, and backups.

Multi-tenant isolation

Each organisation is walled off. Your data is logically isolated and scoped to your organisation alone, enforced both in the application and at the database layer through PostgreSQL Row-Level Security.

Network and application security

Defence in depth. A web application firewall (Google Cloud Armor) inspects inbound traffic and blocks common attacks such as cross-site scripting and SQL injection, with geo-restriction and per-client rate limiting. Our databases run on private networking with no public IP address.

Compliance

SOC 2 Type 1. ZiplineOS achieved SOC 2 Type 1 compliance in August 2026, independently audited against the AICPA Trust Services Criteria, with controls monitored continuously through Vanta. Review our live control status and request the full report any time in our Trust Center.

Australian privacy law. We handle personal information in accordance with the Privacy Act 1988 (Cth) and the Australian Privacy Principles. See our Privacy Policy for data-handling and sub-processor detail.

Responsible disclosure

Found something? Tell us. If you believe you've found a vulnerability, email security@codenexas.com.au. We will acknowledge your report and work with you on remediation.