Security Policy

This is a summary of what's actually in place today, not a marketing list:

• Every file is encrypted at rest (AES-256-GCM) before it's stored
• Passwords are hashed with Argon2 - we never store or see them in plain text
• Optional two-factor authentication (TOTP) with one-time recovery codes
• Every upload is scanned for malware; sharing is blocked until a file is confirmed clean
• Sessions live in an httpOnly, Secure cookie - never in browser storage a script could read
• You can view and remotely sign out any of your own active sessions at any time
• All traffic runs over TLS with HSTS enforced
• Rate limiting on login, password reset, and every API endpoint to slow down abuse

No system is perfectly secure, and we don't claim otherwise - this list is what we do to reduce risk, not a guarantee. See our Privacy Policy for how your data is used and retained.

If you believe you've found a security vulnerability in ZDrive, please email info@zennialhub.in with a description of the issue and steps to reproduce it. We aim to acknowledge reports within 3 business days.

Please don't publicly disclose a vulnerability before we've had a reasonable opportunity to investigate and address it.

In scope: zhdrive.in and its API. Please don't test against other users' accounts or data without explicit permission - test only against an account you control.

Out of scope: denial-of-service testing, spam/social engineering against our staff or users, and automated scanning that generates significant load against production systems.

• Don't access, modify, or delete data that isn't yours
• Don't run automated tools that could degrade service for other users
• Don't exfiltrate more data than needed to demonstrate an issue

We won't pursue legal action against anyone who reports a vulnerability in good faith, in line with this policy. We'll keep you updated as we investigate and fix confirmed issues.

A machine-readable version of this contact information is published at /.well-known/security.txt per RFC 9116.