Security & data protection

All connections to Zrelic — including your dashboard, portal links shared with clients, and API calls between services — are encrypted with TLS 1.2 or higher (HTTPS). Plain-HTTP requests are automatically redirected to HTTPS. Certificates are managed and renewed automatically by Vercel.

Studio owners sign in to the dashboard with an email address and a password. Passwords are never stored in plain text — they are hashed with bcrypt — and we rate-limit sign-in attempts to resist brute-forcing.

Clientsnever create a password. To open a portal, the client enters (or is sent) a one-time verification link to the email address on file (a “magic link”). That link is single-use, expires shortly after it is issued, and its issuance is rate-limited — so possession of a portal URL alone is not enough to see anything.

Once a verification code is confirmed, we set a signed, HttpOnly, Secure session cookie. The portal pages and every client action (viewing files, leaving comments, approving work) are protected by that email-verified session — possession of a portal URL alone does not open the portal. Sessions expire after a fixed period and are invalidated on sign-out. Each portal is scoped to its own project: a verified session for one project does not grant access to another.

Portal links are long, randomised, and unguessable. A project’s access link is created once and is not currently self-serve rotatable in the app; treat portal links as confidential. If you believe a link or a file has been exposed, you can delete the affected files or the whole project from your dashboard at any time, and you can email security@zrelic.com for help.

Application code uses parameterised queries exclusively; user input is never interpolated directly into SQL statements, preventing SQL-injection attacks. The database (Neon Postgres) is not directly accessible from the public internet — connections are authenticated and restricted by network policy.

Files you upload are stored on Vercel Blob. Each file is given a long, randomised, unguessable URL. To be clear about what this does and does not mean: these URLs are not listed or browsable, but they are notsigned, short-lived, or individually access-controlled — anyone who has the exact URL can open the file directly without signing in. You should therefore treat a file’s direct URL as a private link and share it only with people who should see it. You can delete any file (or an entire project) from your dashboard at any time, which removes it from storage.

Zrelicuses Stripe for payments. Card numbers and sensitive payment details are entered directly into Stripe’s PCI-DSS-compliant hosted fields and never pass through our servers. We store only Stripe customer and subscription IDs.

Internally we apply least-privilege access: team members and automated systems are granted only the permissions they need to perform their function. Production database credentials are held in environment variables, not in source code.

Zrelic is built on:

• Vercel — application hosting and file storage. Vercel maintains SOC 2 Type II certification.
• Neon — managed Postgres database. Neon is SOC 2 Type II certified and encrypts data at rest.
• Stripe — payments. Stripe is PCI-DSS Level 1 certified.
• Resend — transactional email delivery.

Zrelic itself has not independently obtained ISO 27001, SOC 2, or similar certifications. We rely on the security programmes of our infrastructure providers and apply the engineering controls described above.

If we become aware of a security vulnerability we will assess the impact and apply fixes as quickly as practicable. In the event of a personal data breach we will notify affected users and — where required — the Information Commissioner’s Office, without undue delay.

If you discover a potential security issue, please report it responsibly to security@zrelic.com. We ask that you give us reasonable time to investigate before public disclosure. We do not currently operate a formal bug-bounty programme, but we will acknowledge good-faith reports promptly.

For general security or data-protection questions, email hello@zrelic.com. See also our Privacy policy.