Zenkit Security
We use Zenkit every day
We use Zenkit every day to interact with you, our customer, and to continue to develop Zenkit itself. We take the utmost care to protect the data entrusted to Zenkit, because if your data is at risk, so is ours. Protecting your data and ours is therefore our highest priority.
Zenkit Web App Security
We create automatic daily backups of all Zenkit data. Zenkit uses Amazon Web Services based in Frankfurt. In order to operate in compliance with the GDPR and the BDSG, we have entered into a data processing agreement pursuant to Art. 28 GDPR with all sub-processors. We fully comply with these regulations. Visit our GDPR page to learn more.
Data Center Security
Amazon Web Services (RDS & S3, contractual partner AWS Luxembourg) employs a robust physical security program with multiple certifications, including an SSAE 16 and ISO27001 certification. Amazon has built in redundancies and continually monitored servers. For more information on Amazon’s physical security processes, please visit aws.amazon.com/security.
Encryption
- Web connections are protected by TLS 1.2 or higher (TLS 1.2 is currently still recommended as a secure encryption protocol by the BSI (Technical Guideline TR-02102-2, as of 2026) as well as by NIST (SP 800-52 Rev. 2)).
- Insecure connections using TLS 1.1 or lower, as well as RC4, are not permitted.
- Data is encrypted at rest
- All passwords are encrypted using the strongest encryption algorithm available
- No leaked passwords can be used
Security Features
- No guest access allowed: This means that each user needs an account for access
- No external file sharing allowed: Generated links to files aren’t shareable
- Two-Factor Authentication (2FA) via authenticator app, Single Sign-On (SSO), and native authorization are supported.
- Multi-tenant isolation: Customer data is logically separated and strictly assigned to an organization. Access permissions are verified server-side on every request.
- Zenkit AI without cross-tenant responses: Responses are based exclusively on content to which the respective user has access within their organization. AI models are invoked statelessly, do not store input data, and are not trained on customer data. Assistants and templates are only visible within your own organization.
- Zenkit AI is protected against prompt injection, operates solely within the permissions of the authenticated user, and only executes modifying actions upon explicit human approval.
Your Data Is Yours
We know there are a lot of companies that collect data to make money. That’s not us. We want you to be productive. If that is with us, great! If you want to take your data with you to another service, we’ll be sad, but you can export it all and take it with you. You can also completely remove all of your data from our servers in compliance with GDPR.
| Servers located in Germany |  |
| AI Features: Processing in the EU | |
| Backup servers in Germany | |
| European contracting partner for data hosting | |
| SSL via HTTPS | |
| Encrypted passwords (Argon2) | |
| Encryption at rest (AES-256) | |
| Native authorization | |
| Two-Factor Authentication (2FA) via authenticator app | |
| File Access Management | |
| Daily encrypted backups in a separate data center in Frankfurt | |
| Single Sign-On | |
| Intrusion Detection System | |
| Multi-tenant isolation including dedicated search and vector indices | |
| No AI training on customer data | |
| Identity and access management | |
Found a vulnerability?
If you believe you have found a security vulnerability in Zenkit or our services, please report it confidentially to security@zenkit.com. Your report goes directly to our Information Security Officer.