Encryption in transit
Production sites and APIs we deliver use HTTPS, and internal service traffic is encrypted wherever the platform supports it.
Trust Center
How we protect your work, and how we work with you.
Plain descriptions of what we actually do. Zavtech does not claim certifications such as SOC 2 or ISO 27001.
Security practices
Least-privilege access
People and services get the access their task needs and no more. We prefer scoped accounts in your systems over shared logins.
Backups
Production databases we manage have automated backups, and we test restores on a schedule agreed in your scope.
Dependency hygiene
We keep dependencies current, review security advisories, and remove packages that are no longer needed.
Secret management
Keys and credentials are kept out of source code, held in environment or secret stores, and rotated when access changes.
Access off-boarding
When an engagement ends, we remove our access and confirm this to you in writing.
Engagement policies
Milestone-based governance
Work is divided into milestones with written sign-offs, so scope, budget and progress stay visible at every step.
Custom-order workflow
Each engagement is scoped and quoted individually. Work begins after the proposal is accepted and the agreed advance is received.
IP and code ownership
Ownership of custom code, design files and brand assets transfers to you on final payment. Third-party licenses stay under their own terms.
Asynchronous, text-first communication
We do not take or make calls. Written communication gives you a record of every decision, lets your stakeholders read the same facts, and works across time zones without scheduling.
Response-time standards
We aim to answer new briefs within one business day. Project and incident response targets are agreed in your proposal or SLA.
Data handling
We use client data only to deliver the work, keep it in your accounts wherever possible, and delete our working copies at off-boarding on request.