Security & Vulnerability Disclosure

Version 2026-10-v2 · Australian English

ZimQi is built with defensive engineering to protect workforce and billing data. Built in Australia. Your data is kept separate per company (database-level isolation) on a server in Malaysia (Hostinger). It is encrypted in transit.

Security architecture & controls

🔒 Tenant isolation

PostgreSQL Row-Level Security (RLS) and scoped data queries enforce isolation per company. Every tenant query is pre-filtered by tenant context.

🛡️ Least privilege & MFA

Platform administration routes require TOTP multi-factor authentication, dedicated short-lived sessions, and personal details masked by default on admin screens (unmasking needs a reason and is logged).

📜 Audit log

The company audit log cannot be edited or deleted. Approval history is permanent. We keep a permanent, timestamped record of approvals, edits, exports and admin changes (who did it and when).

🔐 Transport & session hardening

HSTS with strict transport security, double-submit CSRF protection, and TLS for data in transit. Connected-service credentials are encrypted and only decrypted when an adapter needs them.

Coordinated vulnerability disclosure

We welcome reports from security researchers and practitioners to help keep our users and infrastructure safe. If you believe you have discovered a security vulnerability in ZimQi, please report it to us responsibly.

Reporting a vulnerability

Please email details to: security@zimqi.com.au

  • Provide a description of the issue and steps or proof-of-concept needed to reproduce it.
  • Do not disclose or publish the vulnerability before we have investigated and resolved it.
  • We target acknowledging reports within 5 business days and keeping you updated on the resolution timeline.

Safe harbour & rules of engagement

If you conduct your research in good faith and comply with these guidelines, we consider your research authorized and will not initiate legal action against you:

  • No data violation: Do not access, view, modify, or download data belonging to other customers or accounts. Only test against accounts you own or have explicit permission to test.
  • No denial of service: Do not execute denial of service (DoS/DDoS) attacks, automated volume floods, or disrupt service for real users.
  • No social engineering: Do not attempt phishing, physical attacks, or social engineering against our staff, contractors, or customers.

Security standard (RFC 9116)

Our digital security policy declaration is available at /.well-known/security.txt.