Security, in practice.

01How we think about security

Security is not a phase at the end of a project. It is a set of habits applied from the first commit: least-privilege access, secrets kept out of code, dependencies watched, and a written record of who can reach what. Nothing here is exotic — it is simply non-negotiable on all twenty-five services we deliver.

02Access and identity

• Two-factor authentication on every business, cloud and client account we hold.
• Named individual accounts only. No shared logins, no passwords in chat.
• Credentials stored in a managed secrets vault and rotated when a team member rolls off.
• Quarterly access reviews, and same-day revocation when an engagement or employment ends.

03Secure delivery

• Dependency and vulnerability scanning on every repository, with upgrades handled inside the maintenance retainer.
• Input validation, parameterised queries, output encoding and enforced HTTPS as defaults, not hardening tasks.
• Peer review before anything reaches a production branch.
• Separate development, staging and production environments, with masked or synthetic data outside production.

04Infrastructure and monitoring

Systems we host run on AWS or Azure in the region you need, with encrypted storage, encrypted and tested backups, and network access limited to what the application actually requires. Uptime, error and performance monitoring routes alerts to a named engineer with a written runbook, which is why the platforms we manage have held 99.95% uptime.

05Payments and sensitive data

We integrate gateways so that card data goes straight to the provider — Zentek servers and Zentek staff never store or see full card numbers. Webhooks are signature-verified, refunds and retries are idempotent, and every money-moving action leaves an audit log you can read.

06If something goes wrong

Suspected incidents go to a director within the hour and to you as soon as we can describe what happened. You get containment first, then a written timeline, root cause and the fix — not a vague apology. Post-incident actions are tracked to closure like any other delivery item.

Found a vulnerability on this site or on something we built? Email contact@zenteknetwork.com with the words "Security report" in the subject. We acknowledge within one business day and will never take issue with a good-faith report.

07Compliance support

We regularly help clients meet GDPR, DPDP Act and enterprise procurement requirements: data-flow mapping, retention rules, consent handling, DPAs, access controls and audit trails. We are happy to complete your security questionnaire, and we say plainly when a control is a client responsibility rather than ours.