> ## Documentation Index
> Fetch the complete documentation index at: https://docs.zespan.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Security

> How Zespan protects your data: encryption, authentication, tenant isolation, PII controls, audit logging, and data deletion.

## Encryption

All data is encrypted at rest using AES-256 and in transit over TLS 1.2+. API keys are stored as one-way hashes — the raw key is never persisted after the initial display to you.

## Authentication

* API keys are project-scoped. Each key can only write events to the project it was created for.
* Dashboard login supports email/password, OAuth (GitHub, Google), magic link, and TOTP two-factor authentication.
* SSO (OIDC — Okta, Azure AD, Google Workspace, or any generic OIDC provider) is available on the Team plan and above. See [SSO](/platform/sso) for setup.

Rotate any key at any time from **Settings → API Keys**. The old key stays valid for 24 hours to allow zero-downtime rollover.

## Tenant isolation

Every organization's data is isolated at the storage layer. Queries from one organization cannot access another organization's data — this is enforced at the data layer, independently of application logic.

## Prompt and response data

Zespan stores prompt text and LLM responses **by default**, with PII redaction applied before transmission — this is what powers evaluations, prompt-linked traces, and debugging. If you don't want raw content stored, disable it explicitly:

```typescript theme={"theme":{"light":"github-light","dark":"one-dark-pro"}}
zespan.init({
  apiKey: "zsp_...",
  storePrompts: false, // disable prompt storage (on by default)
});
```

With `storePrompts: false`, only token counts, latency, cost, and structured metadata are sent — never raw prompt or completion text.

**Your data is never used to train any AI model** — by Zespan or any third party.

## PII redaction

For structured fields (`tags`, `metadata`), the SDK automatically redacts values under common sensitive key names before events are sent. Default redact list covers `password`, `token`, `secret`, `api_key`, `authorization`, `ssn`, `credit_card`, and more.

Extend or replace the list at init:

```typescript theme={"theme":{"light":"github-light","dark":"one-dark-pro"}}
zespan.init({
  apiKey: "zsp_...",
  redactKeys: ["user_email", "phone_number", "patient_id"],
});
```

See [PII redaction](/sdk/pii-redaction) for the full default list and pattern-based redaction.

## Audit logging

Every privileged action in the dashboard is written to an immutable audit log:

* API key creation and revocation
* Project creation and deletion
* Alert and guardrail changes
* Team membership changes
* Billing updates

Each entry records timestamp, acting user, organization scope, action type, and source IP. Available in **Settings → Audit Log**. Entries cannot be modified or deleted, even by organization owners.

## Data controls

Full control over your data — what's collected, how long it's kept, and how to get it out or delete it.

### Prompts and responses stored by default, opt-out available

Zespan stores prompt and completion text by default with PII redaction applied before transmission. Set `storePrompts: false` to disable prompt storage entirely — only token counts, latency, cost, and metadata will be sent.

### PII redaction at ingest

The SDK redacts sensitive values from `tags` and `metadata` fields before events are transmitted. The default list covers `password`, `token`, `secret`, `api_key`, `authorization`, `ssn`, `credit_card`, and more. Extend it at init:

```typescript theme={"theme":{"light":"github-light","dark":"one-dark-pro"}}
zespan.init({
  apiKey: "zsp_...",
  redactKeys: ["user_email", "phone_number", "patient_id"],
});
```

Pattern-based redaction (regex) is also supported. See [PII redaction](/sdk/pii-redaction).

### Configurable data retention

Your plan's retention window is enforced on every read. Traces, evaluation scores, guardrail events, and incident events older than the window are excluded from every API response and dashboard view — there is no query, filter, or date range that returns them.

### Export your data

Download a complete export of your account data from **Settings → Privacy → Export my data**. The archive includes your account details, project metadata, and all stored events. Delivered within 24 hours.

### Erase your data

* **Delete a project:** Settings → Projects → Delete project — all event data purged within 24 hours.
* **Delete your organization:** Settings → General → Danger zone — all data across all projects permanently and irreversibly deleted.
* **Delete your account:** Settings → Privacy → Delete my account — removes your user record and cascades deletion across all associated data.

### Data access requests

Request a structured copy of everything Zespan holds about your account from **Settings → Privacy → Request my data**. Requests are tracked with a hard deadline — you receive a response within **30 days**.

## Self-hosted deployments

With the self-hosted option, Zespan has **no access** to your trace data, prompts, or user data — everything stays within your own infrastructure. See [Self-hosting](/platform/self-hosting).

## Responsible disclosure

Report security vulnerabilities to [security@zespan.com](mailto:security@zespan.com). We respond within 48 hours and patch confirmed vulnerabilities within 14 days.