Security & Trust

Whistleblower report subjects, descriptions, contact details, and involved-person fields are encrypted at rest using AES-256-GCM (authenticated encryption). Every record uses a unique 12-byte random initialization vector, and each ciphertext carries a 16-byte authentication tag that makes undetected modification impossible.

Keys are never shared across customers. A master key (held as an environment secret, never stored in the database) is passed through HKDF-SHA256 key derivation with the tenant identifier as derivation context, producing a distinct encryption key per organization. A compromise of one tenant’s derived key does not affect any other tenant.

The platform operates fail-closed: if the encryption key is not configured or an encryption operation fails, new report submissions are rejected rather than stored in plaintext. Report submission is unavailable before it is insecure.

Every security-relevant action — report submission, status change, message sent, attachment download — produces an entry in an immutable audit log. Each entry contains a SHA-256 hash of the previous entry’s content plus its own content hash, forming a verifiable chain: altering or deleting any historical record breaks the chain and is detectable.

Integrity is enforced at the storage layer, not just the application layer: PostgreSQL triggers permanently block UPDATE and DELETE operations on the audit log table. Even a compromised application credential or a successful SQL injection cannot rewrite audit history. The log operates as an append-only ledger.

Reports are anonymous by default. The platform does not store reporter IP addresses: rate limiting runs on transient in-memory counters that exist only for the duration of the time window and create no persistent identity records. Portal-originated audit entries record the actor as null by design.

Reporters follow up on their case through a private access token issued at submission — no account, no email address, no name required.

Every administrative account can enable time-based one-time password (TOTP) two-factor authentication — RFC 6238, compatible with Google Authenticator, Authy, 1Password, and any standard authenticator app. Enrollment uses a QR code or manual Base32 key; ten single-use recovery codes are issued at activation, and only their SHA-256 hashes are stored so they can never be recovered from the database. The TOTP secret itself is encrypted at rest with AES-256-GCM under a dedicated HKDF-SHA256 key derivation.

Brute-force resistance is layered: sign-in and verification endpoints are IP rate-limited (10 attempts per 5 minutes at the edge), and accounts progressively lock after repeated failures (15 minutes, doubling up to a 24-hour cap). Disabling two-factor requires both the account password and a currently valid code, so a stolen session alone cannot remove the protection.

Each organization configures its own retention period (default: 36 months). Closed cases exceeding the configured period are permanently purged by scheduled retention jobs. Administrators can export case data (CSV/JSON) at any time for their own records.

SLA metrics (acknowledgment, response, follow-up, resolution) are computed per case with automatic escalation on breach, so silence is never the default outcome.

Zeitgeist Confidential is built on secure, professionally managed cloud infrastructure selected to support the confidentiality, integrity and availability of the service. Customer data at rest lives in Supabase’s managed PostgreSQL on AWS US East (North Virginia); see Data Residency & Backups below, and the subprocessor detail in our DPA.

We use a carefully selected network of trusted technology and service providers to support core functions such as application hosting, secure data storage, communications and service delivery. These providers are engaged only where necessary to operate and maintain the platform and are subject to appropriate security and confidentiality requirements.

Appropriate technical and organisational safeguards are implemented to help protect information processed through the platform, including measures designed to protect data in transit and at rest, manage access and support the ongoing security and reliability of the service.

We do not sell report data or use confidential reports for advertising or unrelated commercial purposes.

Our underlying infrastructure and service providers may change from time to time as we continue to maintain, improve and secure the platform. Where required, customers will be notified of material changes in accordance with applicable contractual or legal obligations.

Persistent customer data — report content, case records, attachment metadata, and administrative accounts — is stored in a single primary database region: AWS US East (North Virginia, us-east-1), on Supabase’s managed PostgreSQL. The application layer runs on Vercel’s global edge network for speed, but it does not persist report data. One region means one answerable location for procurement and data-protection reviews — and low, consistent latency for users across the Caribbean.

Customer data is backed up daily as part of every plan (recovery point objective: up to 24 hours). Enterprise plans additionally include Point-in-Time Recovery (PITR) on the production database, narrowing the recovery point to minutes for scenarios like accidental deletion or data corruption, with a target recovery time objective of 24 hours for full restoration. Extended retention schedules or residency-specific documentation can be provided for Enterprise procurement on request.

Backups exist for resilience only and are subject to the same deletion commitments as production data: on termination, Customer Data is deleted from production systems and ages out of backup cycles within the window described in the DPA (Section 9).

We welcome reports from security researchers and will not pursue legal action against good-faith research that respects user privacy and service availability.

• Report to: support@zeitgeistbusiness.com (or via /.well-known/security.txt)
• Acknowledgment: within 72 hours
• Safe harbor: good-faith, non-disruptive testing is authorized — avoid privacy violations, service degradation, and social engineering
• Exclusions: denial-of-service, spam, and attacks targeting our customers’ reporters

Platform health is monitored continuously and published live on our status page — real checks against the production database and reporting portal, not a marketing claim. Machine-readable disclosure details are available at/.well-known/security.txt.

Questions about this page, our infrastructure providers, or data handling can be directed to support@zeitgeistbusiness.com.