Menu
We follow strict administrative, operational, and technical practices to protect your data. Our security team continuously improves threat detection and mitigation, ensuring your information is always safeguarded.
Zakeke products are built for stability and security at scale. Our business continuity, disaster recovery, and backup programs minimize the impact of any disruptions on your operations.
We’re committed to keeping your data private and protected. We support global privacy regulations like GDPR and provide governance tools to help you manage your data securely and stay in control.
We take several steps to ensure the security of our systems:
Zakeke secures its network with layered controls, separating infrastructure into zones and environments. Only authorized services can communicate, and all traffic is encrypted through VPC routing and firewalls.
Security is embedded in every part of our daily processes:
Our production systems run on cloud infrastructure, with all services tracked in a custom database. This ensures that new deployments are automatically updated and monitored for consistency.
Only authorized engineers can manage configurations in our production environment. Configuration management tools enforce consistency, preventing unauthorized changes to our systems.
We aggregate and monitor logs from various systems for suspicious activity. Logs are retained for 30 to 365 days and form a key part of our incident detection and response strategy.
Zakeke products and data are hosted on Microsoft Azure, leveraging global redundancy and failover options. We use multiple regions, including West Europe, France Central, and Germany, to ensure that no single data center failure affects the availability of your products or data.
All customer data is encrypted in transit using TLS 1.2+ with Perfect Forward Secrecy (PFS) to protect against unauthorized access. Data at rest is secured with industry-standard AES-256 encryption.
We ensure customer data is logically separated within our cloud infrastructure. The Tenant Context Service (TCS) guarantees that each tenant’s data remains isolated, preventing any crossover between customers.
Only authorized Zakeke employees can access customer data. We use role-based access control, 2FA, and stringent authentication protocols to secure all data access, ensuring tight controls and monitoring.
We use salted password hashing to protect user passwords, making them secure even if breached.
All data between you and Zakeke is encrypted using HTTPS, ensuring secure communication.
Zakeke uses OAuth 2.0 to authorize third-party apps securely, without exposing your login credentials.
To prevent SQL injection, we use parameterized queries and stored procedures to secure our databases.
We block malicious code and unauthorized requests with anti-XSS filtering and token-based validation.
CAPTCHA and session management protect against brute force attacks, keeping your login sessions secure.
Payments are handled through Chargebee, a PCI-DSS Level 1 provider, ensuring secure transactions.
Zakeke leverages Microsoft Azure’s robust infrastructure to protect against DDoS and network threats.
We regularly scan and patch vulnerabilities to keep your data safe from new threats.
As a controller, Zakeke oversees data from users who create an account on the platform or individuals/legal entities it interacts with.
Governs the management of personal data for those who create an account on Zakeke.
Zakeke acts as the processor for data collected during platform operations and for all data of our customers’ clients (e.g., email addresses for quotes or uploaded images). For these data, the controller is the merchant itself, which has a direct relationship with the end user.
When customers create a Zakeke account, they:
No, Zakeke does not process sensitive data. Our platform only manages basic information, such as email addresses and minimal data required to operate the service, ensuring compliance with privacy standards.
Yes, Zakeke is fully GDPR compliant and applies GDPR rules to all customers, not just those in Europe.
The retention period varies based on the type of data. Zakeke collects only the data required to operate the platform and strives to delete or anonymize it once its purpose is fulfilled. For other data, Zakeke deletes all assets 2 years after a subscription is canceled, while account data are removed upon the client’s request.
Yes, clients can request data deletion at any time, and Zakeke is required to comply with this request as part of their data rights.
No, there’s no need to create a separate DPA. Zakeke includes a Data Processing Agreement (DPA) as part of our General Terms and Conditions, so it’s already in place when you become a customer.
