How we look after your data

Where it lives, how it is backed up and encrypted, who on our team can see it — and how to tell us about a security problem.

Where your data is

The platform, its database, and the files you give us — tickets, attachments, chats and identity documents — are held on our own equipment in our data centre in Dhaka.
Some providers we work with process data outside Bangladesh: the payment gateways, the domain registrars, Meta (WhatsApp and Messenger) and Cloudflare. Our privacy policy lists each one and what it receives.

Our own systems are backed up every night and kept for 14 days in the data centre. Copies leave it only encrypted, to two places: our backup server in Bangladesh and a storage provider outside Bangladesh.
cPanel hosting accounts are backed up every night on their server, and the last 7 days are kept. VPS are backed up every night in their panel, and the last 3 days are kept. Dedicated servers and colocation are not backed up by us — that is yours to arrange.
Every day the platform checks that each hosting server still runs that schedule, and tells our team when one does not.

Identity documents and ticket attachments are encrypted at rest with AES-256. Every page and API is served over HTTPS only.
Passwords are stored only as one-way hashes, are at least 10 characters, and are checked against known data breaches when you set one.
Uploaded files are scanned for malware; a file that fails the scan is kept back.

You can turn on two-factor sign-in for your account. Our staff cannot sign in to the back office without it, and must enter a fresh code again to move money, change anyone's access, or open an identity document.
Staff sessions end after 30 minutes without use and after 8 hours in any case. Opening an identity document requires a stated reason, and every view is recorded.
Every action our staff take on an account is written to an audit log that cannot be edited or deleted.
Card details never reach our servers: you pay on the payment gateway's own page.

We follow the practices of ISO/IEC 27001 for an information-security management system. We are not certified, and we do not claim to be.
Personal data is kept for the periods our privacy policy sets out; an account's personal data is erased a year after it is closed, unless the law requires us to keep it.

Email hello@zeeroow.com with what you found, how to reproduce it, and what you think it allows. You may report anonymously.
Test only against systems we run, using your own account. Do not test a customer's server, website or domain, do not read or change other people's data, and no denial of service, spam or social engineering.
We acknowledge a report within 3 working days, and tell you within 10 whether we can reproduce it and how serious it is. Working days are Sunday to Thursday, Bangladesh time.
Please give us time to fix it before you publish: 90 days from your report, or when we tell you it is fixed, whichever comes first.
We do not run a bug bounty. If you want, we will thank you by name on this page.

The same contact is published at /.well-known/security.txt.