Security

Encryption

All data is encrypted at rest using AES-256 and in transit over TLS 1.2+. API keys are stored as one-way hashes — the raw key is never persisted after the initial display to you.

Authentication

API keys are project-scoped. Each key can only write events to the project it was created for.
Dashboard login supports email/password, OAuth (GitHub, Google), magic link, and TOTP two-factor authentication.
SSO (OIDC — Okta, Azure AD, Google Workspace, or any generic OIDC provider) is available on the Team plan and above. See SSO for setup.

Rotate any key at any time from Settings → API Keys. The old key stays valid for 24 hours to allow zero-downtime rollover.

Tenant isolation

Every organization’s data is isolated at the storage layer. Queries from one organization cannot access another organization’s data — this is enforced at the data layer, independently of application logic.

Prompt and response data

Zespan stores prompt text and LLM responses by default, with PII redaction applied before transmission — this is what powers evaluations, prompt-linked traces, and debugging. If you don’t want raw content stored, disable it explicitly:

zespan.init({
  apiKey: "zsp_...",
  storePrompts: false, // disable prompt storage (on by default)
});

With storePrompts: false, only token counts, latency, cost, and structured metadata are sent — never raw prompt or completion text. Your data is never used to train any AI model — by Zespan or any third party.

PII redaction

For structured fields (tags, metadata), the SDK automatically redacts values under common sensitive key names before events are sent. Default redact list covers password, token, secret, api_key, authorization, ssn, credit_card, and more. Extend or replace the list at init:

zespan.init({
  apiKey: "zsp_...",
  redactKeys: ["user_email", "phone_number", "patient_id"],
});

See PII redaction for the full default list and pattern-based redaction.

Audit logging

Every privileged action in the dashboard is written to an immutable audit log:

API key creation and revocation
Project creation and deletion
Alert and guardrail changes
Team membership changes
Billing updates

Each entry records timestamp, acting user, organization scope, action type, and source IP. Available in Settings → Audit Log. Entries cannot be modified or deleted, even by organization owners.

Data controls

Full control over your data — what’s collected, how long it’s kept, and how to get it out or delete it.

Prompts and responses stored by default, opt-out available

Zespan stores prompt and completion text by default with PII redaction applied before transmission. Set storePrompts: false to disable prompt storage entirely — only token counts, latency, cost, and metadata will be sent.

PII redaction at ingest

The SDK redacts sensitive values from tags and metadata fields before events are transmitted. The default list covers password, token, secret, api_key, authorization, ssn, credit_card, and more. Extend it at init:

zespan.init({
  apiKey: "zsp_...",
  redactKeys: ["user_email", "phone_number", "patient_id"],
});

Pattern-based redaction (regex) is also supported. See PII redaction.

Configurable data retention

Your plan’s retention window is enforced on every read. Traces, evaluation scores, guardrail events, and incident events older than the window are excluded from every API response and dashboard view — there is no query, filter, or date range that returns them.

Export your data

Download a complete export of your account data from Settings → Privacy → Export my data. The archive includes your account details, project metadata, and all stored events. Delivered within 24 hours.

Erase your data

Delete a project: Settings → Projects → Delete project — all event data purged within 24 hours.
Delete your organization: Settings → General → Danger zone — all data across all projects permanently and irreversibly deleted.
Delete your account: Settings → Privacy → Delete my account — removes your user record and cascades deletion across all associated data.

Data access requests

Request a structured copy of everything Zespan holds about your account from Settings → Privacy → Request my data. Requests are tracked with a hard deadline — you receive a response within 30 days.

Self-hosted deployments

With the self-hosted option, Zespan has no access to your trace data, prompts, or user data — everything stays within your own infrastructure. See Self-hosting.

Responsible disclosure

Report security vulnerabilities to security@zespan.com. We respond within 48 hours and patch confirmed vulnerabilities within 14 days.

AI Providers (BYOK)

Deployment

Security & Compliance

Account

Encryption

Authentication

Tenant isolation

Prompt and response data

PII redaction

Audit logging

Data controls

Prompts and responses stored by default, opt-out available

PII redaction at ingest

Configurable data retention

Export your data

Erase your data

Data access requests

Self-hosted deployments

Responsible disclosure

​Encryption

​Authentication

​Tenant isolation

​Prompt and response data

​PII redaction

​Audit logging

​Data controls

​Prompts and responses stored by default, opt-out available

​PII redaction at ingest

​Configurable data retention

​Export your data

​Erase your data

​Data access requests

​Self-hosted deployments

​Responsible disclosure

Encryption

Authentication

Tenant isolation

Prompt and response data

PII redaction

Audit logging

Data controls

Prompts and responses stored by default, opt-out available

PII redaction at ingest

Configurable data retention

Export your data

Erase your data

Data access requests

Self-hosted deployments

Responsible disclosure