01
Collect as little as possible.
The training platform holds workforce data only — names, work emails, job titles, departments, and training records. It is designed not to collect patient data, and we ask clients never to send it.
Security
How we protect
your data.
We are a security company, so this page is written the way we would want a vendor to write one for us: specific, current, and honest about what we have not done yet.
02
No passwords to steal.
Training users sign in with a one-time code sent to their work email. Every Zeblade admin account requires multi-factor authentication.
03
Straight answers.
This page says what we do and what we do not have yet. If your security questionnaire asks something this page does not cover, ask us.
Infrastructure
Where your data lives.
We run on established providers and inherit their physical security and certifications. These are all of them.
Cloudflare
- What it does for us
- Hosts zeblade.com and the training platform (training.zeblade.io): web hosting, server-side functions, the training database (D1), media storage (R2), sign-in (Cloudflare Access), and DNS.
- Whose data
- Website visitors and training platform users.
- Region
- Training database restricted to the United States; web traffic served from Cloudflare's global network.
Backblaze
- What it does for us
- Encrypted, write-protected offsite backups of the training database (Backblaze B2).
- Whose data
- Training platform data, backed up daily.
- Region
- United States (US East).
Proton
- What it does for us
- Business email (Proton Mail).
- Whose data
- Email correspondence with clients and prospects.
- Region
- Switzerland.
Resend
- What it does for us
- Sends transactional email: contact-form notifications, training invitations, and reminders.
- Whose data
- When an email is sent on your behalf.
- Region
- United States.
Anthropic
- What it does for us
- Generates replies for Piper, the chat assistant on zeblade.com. Not used by the training platform.
- Whose data
- Only when a visitor sends Piper a message.
- Region
- United States.
Data protection
Encryption, backups, and deletion.
- In transit
- All traffic to zeblade.com and training.zeblade.io is served over HTTPS. The training platform's server responses carry HTTP Strict Transport Security and a Content Security Policy.
- At rest
- Training data is stored in Cloudflare D1 in a database restricted to the United States, and encrypted at rest by Cloudflare. Offsite backups are encrypted at rest by Backblaze, also in the United States.
- Backups
- The training database has point-in-time recovery through Cloudflare, plus a daily full export to a second provider (Backblaze, US East) so it can be restored even if a Cloudflare account were lost. Each backup is locked against deletion or change for 30 days, then removed automatically.
- Deletion
- When an engagement ends, or when a client asks, we delete that client's data within 30 days unless the client agreement sets a different schedule. Point-in-time recovery history and offsite backups expire on their own within 31 days, so deleted data does not linger in them.
- Training records
- Completion records are written by the server with a server timestamp and are append-only. A completion cannot be quietly edited after the fact; retaking a module adds a new record.
Access control
Who can see what.
- Sign-in. Training platform users authenticate through Cloudflare Access with a one-time code sent to their work email. There are no platform passwords to phish or reuse.
- Every request is checked. Each call to the platform's API verifies the signed sign-in token and enforces the user's organization and role on the server. Users never choose which organization's data they see.
- Least privilege. Three roles: learners see their own training, client administrators manage their own organization, and Zeblade operators manage client accounts. The operator console runs on its own domain behind a separate sign-in that requires Duo single sign-on and is restricted to named Zeblade operators.
- Offboarding. Client administrators can deactivate departing users themselves. Seat limits and allowed email domains are enforced by the server.
- Our own accounts. Every administrative account behind Zeblade's services — hosting, DNS, code, email, and security tooling — requires multi-factor authentication.
Application security
How the platform is built.
- No patient data by design. The training platform has no fields for health information, and departments are chosen from a fixed list rather than typed in.
- Server-side trust. Identity, organization, and quiz grading are all determined on the server. Quiz answer keys never reach the browser.
- Small footprint. The platform has a deliberately short dependency list, which keeps the software supply chain small and easy to review.
- Public media only in public storage. Training videos and audio are served from a CDN. Nothing personal or client-specific is ever stored there.
Incident response
If something goes wrong.
If we confirm a security incident affecting a client's data, we will notify that client within 72 hours, or sooner if the client agreement requires it. The notice will say what happened, what data was involved, what we have done about it, and what the client should do next. We will keep the client updated until it is resolved.
Compliance
Where we stand today.
Zeblade does not currently hold a SOC 2 report or an ISO 27001 certification, and we have not yet commissioned a third-party penetration test. We would rather tell you that here than have you find out in a questionnaire.
Zeblade is founder-operated, led by a CISSP who has run security and compliance programs for healthcare organizations. We are glad to complete your vendor security questionnaire and answer follow-up questions directly. Contracts can include a data processing addendum, and a business associate agreement where an engagement involves access to protected health information.
Vulnerability disclosure
Found a problem? Tell us.
Email security@zeblade.com
with a description of the issue and the steps to reproduce it. We
will acknowledge your report within 3 business days and keep you
posted while we fix it. Our contact details are also published at
/.well-known/security.txt.
Please don't
- Access, change, or delete data that isn't yours.
- Run denial-of-service tests or high-volume automated scans.
- Social-engineer or phish Zeblade, our clients, or their staff.
- Share details publicly before we have had a reasonable chance to fix the issue.
We will not pursue legal action against anyone who reports a vulnerability in good faith and follows these guidelines.
Last updated: October 2026