Security & Encryption Architecture
How Zetaleap protects SSH Private Keys (PEM), Bearer tokens, SFTP streams, and Drive objects.
🔐 Transport & Edge Isolation (TLS 1.3)
Every request to zetaleap.com and our Power Automate Custom Connectors enforces HTTPS with TLS 1.3 and Cloudflare WAF/DDoS protection across 300+ global edge PoPs. Plaintext HTTP API calls are rejected at the edge.
🔑 SFTP SSH Private Key (PEM) & Vault Security
SFTP connection profiles (RSA / Ed25519 PEM keys & credentials) are strictly scoped to the owning user ID with server-side IDOR authorization checks on every directory list, file download, and R2 Storage Vault operation. Private keys are never returned in API responses or client logs.
🪙 CSPRNG Tokens & SHA-256 / PBKDF2 Hashing
Personal Access Tokens (zl_...) are generated using Web Crypto 256-bit CSPRNG entropy. Account passwords use salted PBKDF2-HMAC-SHA256 (100,000 iterations) with constant-time comparison to prevent timing side-channel attacks.
🛡️ Stateless Processing & SSRF Protection
Payloads sent to /api/tools/convert (AI Markdown Formatter) and /api/tools/validate-url are processed ephemerally in V8 Isolate memory and discarded immediately after response — never logged or used for AI training. URL validation enforces strict timeouts and private-network SSRF guards.
Enterprise Security Controls Summary
| Control Domain | Implementation Standard | Status |
|---|---|---|
| Encryption in Transit | TLS 1.3 / HSTS via Cloudflare Global Edge | Enforced |
| Encryption at Rest | AES-256-GCM encrypted Cloudflare R2 & D1 storage | Enforced |
| API Authentication | Scoped Bearer PAT (zl_...) & HMAC-SHA256 JWT | Enforced |
| Tenant Data Isolation | Parameterized SQL + mandatory user_id ownership checks | Enforced |
| Vulnerability Disclosure | Direct security response via support_team@zetaleap.com | 24h SLA |