Security

Encryption

All data is encrypted at rest using AES-256 and in transit over TLS 1.2+. API keys are stored as one-way hashes — the raw key is never persisted after the initial display to you.

Authentication

API keys are project-scoped. Each key can only write events to the project it was created for.
Dashboard login supports email/password, OAuth (GitHub, Google), magic link, and TOTP two-factor authentication.
SSO (OIDC — Okta, Azure AD, Google Workspace, or any generic OIDC provider) is available on the Team plan and above. See SSO for setup.

Rotate any key at any time from Settings → API Keys. The old key stays valid for 24 hours to allow zero-downtime rollover.

Tenant isolation

Every organization’s data is isolated at the storage layer. Queries from one organization cannot access another organization’s data — this is enforced at the data layer, independently of application logic.

Prompt and response data

Zespan stores prompt text and LLM responses by default, with PII redaction applied before transmission — this is what powers evaluations, prompt-linked traces, and debugging. If you don’t want raw content stored, disable it explicitly:

zespan.init({
  apiKey: "zsp_...",
  storePrompts: false, // disable prompt storage (on by default)
});

With storePrompts: false, only token counts, latency, cost, and structured metadata are sent — never raw prompt or completion text. Your data is never used to train any AI model — by Zespan or any third party.

PII redaction

For structured fields (tags, metadata), the SDK automatically redacts values under common sensitive key names before events are sent. Default redact list covers password, token, secret, api_key, authorization, ssn, credit_card, and more. Extend or replace the list at init:

zespan.init({
  apiKey: "zsp_...",
  redactKeys: ["user_email", "phone_number", "patient_id"],
});

See PII redaction for the full default list and pattern-based redaction.

Audit logging

Every privileged action in the dashboard is written to an immutable audit log:

API key creation and revocation
Project creation and deletion
Alert and guardrail changes
Team membership changes
Billing updates

Each entry records timestamp, acting user, organization scope, action type, and source IP. Available in Settings → Audit Log. Entries cannot be modified or deleted, even by organization owners.

Data controls

Full control over your data — what’s collected, how long it’s kept, and how to get it out or delete it.

Prompts and responses stored by default, opt-out available

Zespan stores prompt and completion text by default with PII redaction applied before transmission. Set storePrompts: false to disable prompt storage entirely — only token counts, latency, cost, and metadata will be sent.

PII redaction at ingest

The SDK redacts sensitive values from tags and metadata fields before events are transmitted. The default list covers password, token, secret, api_key, authorization, ssn, credit_card, and more. Extend it at init:

zespan.init({
  apiKey: "zsp_...",
  redactKeys: ["user_email", "phone_number", "patient_id"],
});

Pattern-based redaction (regex) is also supported. See PII redaction.

Configurable data retention

Your plan’s retention window is enforced on every read. Traces, evaluation scores, guardrail events, and incident events older than the window are excluded from every API response and dashboard view — there is no query, filter, or date range that returns them.

Export your data

Download a complete export of your account data from Settings → Privacy → Export my data. The archive includes your account details, project metadata, and all stored events. Delivered within 24 hours.

Erase your data

Delete a project: Settings → Projects → Delete project — all event data purged within 24 hours.
Delete your organization: Settings → General → Danger zone — all data across all projects permanently and irreversibly deleted.
Delete your account: Settings → Privacy → Delete my account — removes your user record and cascades deletion across all associated data.

Data access requests

Request a structured copy of everything Zespan holds about your account from Settings → Privacy → Request my data. Requests are tracked with a hard deadline — you receive a response within 30 days.

Staff access to your account

Zespan support and operations staff can take a small, fixed set of privileged actions on customer accounts. These live behind a separate internal superadmin console — never the customer-facing dashboard — and every one of them is scoped, reasoned, and logged.

Action	What it does
Ban / unban a user	Blocks a specific user’s login. Requires a reason; expiry is optional — set a number of days, or leave it unset for a ban that lasts until a staff member manually lifts it
Set password	Resets a user’s password directly, for account-recovery support
Revoke all sessions	Signs a user out of every active session immediately
Impersonation	Logs a staff member into your account as you would see it, for troubleshooting
Organization suspension	Suspends an entire organization — see below

Impersonation is time-limited to 30 minutes and automatically ends when that window closes. A persistent banner is shown across every page for as long as an impersonated session is active, so it’s never mistaken for your own.

Every superadmin action — ban, unban, password reset, session revocation, impersonation, organization suspension, and reactivation — is written to an internal audit log, permanently and independently of your organization’s own audit log.

Organization suspension

Suspending an organization blocks dashboard and API access for that organization’s members. It does not stop SDK ingest — trace and event data keeps flowing normally, so nothing is lost while an organization is suspended. This is a deliberate design decision: suspension is a billing and compliance control, not a data-loss risk, and reactivating a suspended organization cannot backfill telemetry that was refused while it was down.

Self-hosted deployments

With the self-hosted option, Zespan has no access to your trace data, prompts, or user data — everything stays within your own infrastructure. See Self-hosting. One control moves to you when you self-host: Zespan derives a caller’s IP address from the proxy chain, so your load balancer or CDN must overwrite X-Forwarded-For rather than append to a client-supplied value, and the API must not be reachable around it. That address is what a person compares against when approving a CLI sign-in. See Client IP behind a proxy.

Responsible disclosure

Report security vulnerabilities to security@zespan.com. We respond within 48 hours and patch confirmed vulnerabilities within 14 days.

Next steps

Audit log — your organization’s own record of every action taken inside it
Organizations — team member roles and permissions
Self-hosting — remove Zespan’s access to your data entirely

AI Providers (BYOK)

Deployment

Security & Compliance

Account

Encryption

Authentication

Tenant isolation

Prompt and response data

PII redaction

Audit logging

Data controls

Prompts and responses stored by default, opt-out available

PII redaction at ingest

Configurable data retention

Export your data

Erase your data

Data access requests

Staff access to your account

Organization suspension

Self-hosted deployments

Responsible disclosure

Next steps

​Encryption

​Authentication

​Tenant isolation

​Prompt and response data

​PII redaction

​Audit logging

​Data controls

​Prompts and responses stored by default, opt-out available

​PII redaction at ingest

​Configurable data retention

​Export your data

​Erase your data

​Data access requests

​Staff access to your account

​Organization suspension

​Self-hosted deployments

​Responsible disclosure

​Next steps

Encryption

Authentication

Tenant isolation

Prompt and response data

PII redaction

Audit logging

Data controls

Prompts and responses stored by default, opt-out available

PII redaction at ingest

Configurable data retention

Export your data

Erase your data

Data access requests

Staff access to your account

Organization suspension

Self-hosted deployments

Responsible disclosure

Next steps