Security Overview

This page summarizes the controls that protect a Zernio workspace: how people sign in, how access is scoped once they are in, and what gets recorded. It is written for the person filling in a security review as much as for the developer setting things up.

Signing in

Zernio accounts support four sign-in methods:

Breached-password screening

Every password Zernio accepts (signup, reset, change) is checked against the haveibeenpwned corpus using k-anonymity: only the first five characters of a SHA-1 digest ever leave our infrastructure, never the password itself. A password that appears in a known breach is rejected with a clear message. The check is advisory by design: if the third-party service is unreachable, the password is accepted rather than blocking signups on someone else's outage.

Two-step verification

TOTP authenticator apps plus encrypted backup codes, covered in detail on the two-step verification page.

Sessions and devices

Under Settings → Security every account has:

• A device list. Each active session with enough context to recognize it, and a per-device sign-out.
• Sign out everywhere. Revokes every session for the account, on every device, including sessions that predate the click.

Workspace roles

Access inside a workspace is role-based. Exactly one owner exists per workspace at any moment.

Two scoping mechanisms narrow access further:

• Profile-scoped members. An invite can grant access to specific profiles only, instead of the whole workspace.
• Profile-scoped API keys. An API key can be restricted to specific profiles; requests outside its scope are rejected. Only the owner and full-access members can manage API keys and webhooks, because both are workspace-wide credentials.

Invites are single-use tokens with an expiry, and can be bound to a specific email address so nobody else can claim them.

Audit log

Every team-management action writes an audit entry: invites created, accepted and revoked, members removed, role and scope changes, ownership transfers. Each entry records who performed the action, who it targeted, and when. The log is append-only and available to the workspace owner.

Enterprise controls

On Enterprise agreements, the workspace owner can additionally:

• Connect a SAML or OIDC identity provider, verified by DNS domain ownership.
• Enforce SSO for the whole email domain, which shuts off password and social sign-in for everyone at that domain.
• Sync the employee directory over SCIM 2.0, so the identity provider creates, updates and deactivates Zernio accounts automatically.

SSO and enforcement are covered on the single sign-on page, directory sync on the SCIM page.