Security

Zenviz uses role-based permissions checked on the server for every request, not just hidden in the menu — an employee, manager, HR admin, accounts admin, IT admin and full company admin each see and can act on a different, deliberately scoped slice of the product. Some actions, like changing another admin’s account, are restricted to full company admins only.

Every record — every employee, payslip, lead, task and document — is scoped to the company that created it at the database level. There is no cross-company query path in the product, so one customer’s data is never visible to another’s.

Passwords are stored as salted hashes, never in plain text. New accounts are forced to set their own password on first login rather than keep an admin-issued temporary one, and repeated failed login attempts trigger an automatic lockout.

Sensitive actions — approvals, payments, role changes, password resets — are logged with who did it, what changed, and when, visible to a company’s own admins. Platform-level actions Zenviz staff take on a customer’s account are logged separately and are never shown to the tenant.

Database backups run on a schedule and are integrity-checked immediately after being taken — a backup that fails verification is discarded rather than kept looking healthy. Restores are verified before they touch the live database, and the previous state is kept so a restore is itself reversible.

Found a security issue? Email hello@zenviz.app with details and we’ll respond. Please don’t test against another company’s live data or attempt to access accounts that aren’t yours while investigating.

Zenviz doesn’t currently hold formal certifications like SOC 2 or ISO 27001. Everything on this page describes a mechanism that actually exists in the product today, not a roadmap item or an aspirational claim.