Security

Security is an important part of how ZENIA Assistant is built and operated on buildbot.ro. ZENIA Assistant is a software product operated under the ZENIA Assistant / buildbot.ro brand by Popescu Adrian Florin, an individual operator based in Romania.

The platform is designed to protect customer data through controlled access, workspace isolation, encrypted connections, operational monitoring, and careful handling of indexed content.

This page describes the current security posture at a high level. It is intended to give customers and prospective customers a clear and honest picture of the current approach to security, without overstating controls that are not formally certified or independently audited. This page is updated as practices evolve.

ZENIA is operated on managed infrastructure selected for reliability, isolation, and operational control. Public-facing services are exposed through controlled application entry points, while internal services and administrative functions are restricted.

Production access is intended to be limited to authorised operators and managed according to the principle of least privilege. Infrastructure, deployment, and operational changes are reviewed before being applied where operationally feasible.

The platform is designed to separate customer workspaces and domains so that indexed content, files, and chat activity remain scoped to the correct customer account.

Connections between users and the ZENIA platform are served over HTTPS. Sensitive account operations and dashboard access are handled through authenticated sessions.

Passwords are not stored in plain text. Account credentials are stored using password hashing rather than reversible encryption.

Where managed infrastructure or storage providers are used, their built-in encryption and access-control capabilities may form part of the overall security posture. Specific provider-level encryption details can vary by deployment environment and provider configuration.

Access to the ZENIA platform is governed by account, workspace, and role-based controls. Users are intended to have access only to the workspaces, domains, and resources they own or have been granted access to. Administrative functions are restricted to authorised accounts.

User sessions are authenticated and protected with secure session handling. Sessions may expire automatically after inactivity or when access is revoked.

Access to production systems is restricted to authorised personnel. The principle of least privilege is applied so that operators receive only the access necessary for their responsibilities.

ZENIA is designed with operational resilience in mind. Database and application data may be backed up according to the capabilities of the managed services and deployment environment used by the platform.

Uploaded files and indexed content are managed per workspace. Recovery practices are maintained to reduce the impact of infrastructure or application failures where feasible.

Backup and recovery processes are reviewed as the platform evolves. Formal recovery time objectives and recovery point objectives may be introduced as the service scales.

ZENIA generates operational logs for important application events such as authentication activity, crawling and indexing operations, file ingestion, API usage, and service errors. These logs are used for troubleshooting, security review, and platform reliability.

Sensitive values such as passwords, authentication secrets, and API keys are not intentionally written to logs. Logging is designed to avoid unnecessary exposure of customer content.

Monitoring and alerting may be used to identify service errors, degraded availability, and abnormal operational behaviour. The level of monitoring may evolve as the platform scales.

ZENIA dependencies and application components are reviewed for security and stability issues. Security-relevant updates are prioritised based on severity, exploitability, and service impact.

Where automated dependency or build checks are available, they may be used to help identify known issues before deployment. Findings are reviewed and addressed according to risk.

If you discover a potential security vulnerability in ZENIA, please report it responsibly by emailing contact@buildbot.ro with “Security Report” in the subject line. Do not disclose vulnerabilities publicly before we have had a reasonable opportunity to investigate and remediate. We aim to acknowledge valid reports within 5 business days.

In the event of a confirmed security incident affecting customer data, the service operator will seek to:

• Contain the incident and assess its scope as quickly as reasonably possible.
• Notify affected customers without undue delay.
• Where required under GDPR or applicable law, notify the relevant supervisory authority within the legally required timeframe.
• Provide clear, factual information about what happened, what data was affected, and what corrective steps are being taken.
• Conduct a post-incident review and implement appropriate corrective measures.

Incident notifications will be sent to the registered account email address. Customers are encouraged to keep their account email addresses current.

Knowledge content ingested through website crawling, file upload, or manual text entry is stored and indexed for the purpose of powering the chatbot associated with the relevant workspace. This content is not shared across customer workspaces and is not made available to other customers.

Chat conversations may be stored per session so that workspace owners can review assistant behaviour, sources, and conversation quality. This supports audit, troubleshooting, and improvement of the knowledge base.

When an AI inference or embedding provider is used, the minimum necessary prompt, context, and content snippets may be transmitted to that provider for processing. ZENIA does not use customer knowledge content to train its own general-purpose AI model. Provider-side handling is governed by the relevant provider terms and is described further in the Privacy Policy, Data Processing Addendum, and Sub-processors page.

Uploaded files and associated indexed content can be deleted from the dashboard where deletion controls are available.

ZENIA does not store payment card numbers or full payment credentials. Paid plans are being prepared for launch through Paddle. Where subscription billing is enabled, payment processing may be handled by Paddle or another disclosed payment provider.

The platform stores only the information necessary to manage access and subscription status, such as plan type, billing status, customer identifiers, and transaction or subscription references returned by the payment provider.

Payment-related handling may vary depending on the payment processor used. Customers should also review the privacy and security information provided by the relevant payment processor.

Security is a shared responsibility. As a customer, you are responsible for:

• Keeping your account credentials secure and not sharing them with unauthorised individuals.
• Using strong, unique passwords and enabling any available account security features.
• Ensuring that content you upload or ingest complies with your own privacy, confidentiality, and legal obligations.
• Promptly notifying contact@buildbot.ro if you suspect that your account has been compromised.
• Using the platform in accordance with the Acceptable Use Policy.

Customer-side credential compromise, unsafe content handling, or misuse of the platform can affect the security of the service.

ZENIA is expected to continue improving its security posture as the service grows. Areas under consideration include:

• Independent penetration testing.
• More granular audit logging and customer-facing audit views.
• Two-factor authentication for user accounts.
• Expanded automated security checks in the development and deployment process.
• Formal security and compliance assessments as the business scales.

This list reflects areas under evaluation and does not guarantee delivery dates. This page will be updated as new controls are implemented.