Security & compliance

What ZizkaDB is (and is not)

ZizkaDB stores agent events — decisions, tool calls, messages, and outcomes — with causal links, semantic search over history, time-travel replay, and behavioral baselines. Your application code decides what to log; ZizkaDB persists and queries that operational record.

It does not run your agents, hold OAuth tokens to Gmail/Jira, or make autonomous execution decisions. Those remain in your stack. Managed cloud runs at db.zizka.ai; self-hosted OSS runs entirely on your infrastructure.

Security measures (managed cloud & OSS)

• In transit: TLS on managed cloud (db.zizka.ai via nginx). Use HTTPS for all API and dashboard traffic.
• Tenant isolation: every API call is scoped by API key (zizkadb_live_*) or dashboard JWT to a tenant_id. Cross-tenant reads are blocked at the API layer.
• At rest: Postgres, Qdrant, and Redis on managed cloud use standard AWS disk encryption (EBS). Self-hosted deployments use encryption on your operator's infrastructure.
• Integrity: each logged event includes a SHA-256 checksum for payload verification. Append-by-default writes; forget() supports targeted erasure.
• Bring-your-own-key embeddings: when you supply an OpenAI key for semantic search, it is stored encrypted (Fernet) in Postgres — we do not use it for any purpose other than generating embeddings you request.
• Authentication: dashboard login uses email OTP → JWT. API access uses bearer tokens. Rate limiting on auth and public endpoints reduces abuse.
• Anonymous telemetry (optional): SDK/MCP may send one anonymous install ping per process (SDK type, version, OS, coarse country — no API keys or agent data). Opt out with ZIZKADB_TELEMETRY=false.

Data privacy & GDPR

You control what agent data and metadata you log. ZizkaDB provides forget(filter_key, filter_value) to delete matching events and vector embeddings together — supporting GDPR right to erasure.

Managed plans enforce retention windows (e.g. 90 days Pro, 1 year Team). Self-hosted retention is operator-defined. For self-hosted OSS, you are the data controller for data in your instance; we do not access it unless you share logs or contact support.

Full policy: zizka.ai/privacy and db.zizka.ai/privacy (managed cloud).

Sub-processors (managed cloud)

When you use semantic search on managed cloud, event text may be sent to OpenAI for embedding generation only — under your plan or your BYOK key. Vectors are stored in Qdrant; events and accounts in PostgreSQL. Billing uses Stripe. Infrastructure runs on AWS (EU-operated entity: ZIZKA AI S.L., Málaga, Spain).

We share the minimum data required for each service. We do not use your agent event payloads to train general-purpose models. Self-hosted installs can disable cloud embeddings and keep all data local.

EU AI Act & responsible AI

ZizkaDB is infrastructure and record-keeping — not a standalone AI system making autonomous decisions. It helps deployers with traceability, human oversight evidence, and monitoring (Articles 12–14, 26 direction). It does not replace your own risk classification or conformity assessment.

See the product mapping at db.zizka.ai/eu-ai-act. Technical architecture and API details: db.zizka.ai/trust.

What we do not claim today

ZizkaDB v1 targets developers and small teams. We do not currently hold SOC 2, ISO 27001, or HIPAA certification. Formal DPAs and VPC/enterprise security reviews are available on request.

Enterprise deployment and security review: db.zizka.ai/enterprise or founder@zizka.ai.

Responsible disclosure

If you believe you have found a security vulnerability in ZizkaDB managed cloud or the open-source repository, please report it to founder@zizka.ai with enough detail to reproduce. We aim to acknowledge reports within a few business days and will coordinate fixes before public disclosure when appropriate.