Security
The measures that protect your data in Nozero, as built into the product.
Encryption
| Where | How |
|---|---|
| Before upload | Backup content is compressed and encrypted with AES-256-GCM by the agent, inside your network. |
| Keys | Each storage repository has its own key, sealed at rest with a platform master key. Owners can reveal their recovery key; every reveal is recorded in the audit log. |
| In storage | Object names are keyed hashes, so the storage provider learns nothing about the content. |
| In transit | TLS 1.2 or later on every connection, with HSTS. |
Integrity and recovery
Every chunk and snapshot is checked against its hash when read, and verification jobs can read every byte. Scheduled restore tests check each restored file's SHA-256 and keep evidence of the result. Agents never hold storage credentials and cannot delete or overwrite stored data; restores and downloads can require a second person's approval.
Access control
| Control | How |
|---|---|
| Roles | Built-in and custom roles, projects and groups; access granted organization-wide or per project. |
| Sign-in | Two-factor authentication, which organizations can require for everyone; lockout after repeated failures, with a notice to the account owner. |
| Sessions | Short-lived tokens and a host-bound, HttpOnly, Secure, SameSite=Strict cookie; sign-in requests from other sites are refused. |
| Administration | The platform console is served only at a private address, can be limited to approved networks, and requires two-factor sign-in; staff roles limit what each staff member can change. |
| Audit | An append-only log of sign-ins, changes, restores, downloads and key reveals that cannot be edited or deleted. |
Network and operations
Agents and devices connect outbound only: nothing in your network accepts inbound connections. Scans and reconnaissance are detected and blocked. The platform's own database and configuration are backed up daily and checked before they are kept. Updates are deployed with a backup taken first, health checks and automatic rollback, and dependencies are reviewed with each release.
Incidents
If we become aware of a personal data breach affecting your data, we notify you without undue delay and in any case within 48 hours, and support your own notifications, including the 72 hours of the GDPR and notification to the Data Protection Board of India under the DPDP Act.
Data lifecycle
You set retention for every backup plan, configuration device and app. After termination you can export your data for 30 days; we then delete it from managed storage and our systems within a further 30 days, except records the law requires us to keep. Data in storage you own stays under your control.
Report a vulnerability
Use the report form or email connect@activejoules.com with the details and steps to reproduce. We acknowledge reports within three business days and keep you informed. If you act in good faith, avoid privacy violations and service disruption, and give us reasonable time to fix the issue before disclosure, we will not pursue legal action. Our security.txt has the same contact.