Zinye is built on ERPNext — the open ERP that runs tens of thousands of businesses worldwide. The standard we hold ourselves to: your data should be as safe with us as it would be with a finance team that's worked at your company for ten years.
Annual third-party audit of our security, availability, confidentiality and processing-integrity controls.
Information security management system certified by an accredited registrar. 27018 covers PII in the cloud.
Data processing addendum, EU-US DPF, sub-processor list and DPO contact published. Region pinning on Scale+.
HIPAA BAA available on healthcare tenancies. PCI-DSS SAQ-A for retail and POS. Sector add-ons.
Trust isn't a badge.
It's a habit — practiced every week,
audited every year.
How we protect what you put in.
Encryption everywhere.
AES-256 at rest, TLS 1.3 in transit, perfect forward secrecy. Customer-owned encryption keys (BYOK via AWS KMS, GCP KMS, Azure Key Vault) on Enterprise.
Identity without the friction.
SAML 2.0 and OIDC single sign-on, time-based OTP, hardware keys, biometric. Field-level RBAC with "view as" testing. SCIM provisioning for joiners and leavers.
Residency you choose.
Three regions by default — EU (Frankfurt), US (Virginia), APAC (Singapore). Scale and Enterprise plans pick specific regions; Enterprise can deploy single-tenant in your AWS, GCP or Azure subscription.
Recovery — boring by design.
Encrypted snapshots every 6 hours, retained 30 days. Point-in-time restore on Scale+. Off-site copy to a different cloud and region. RPO < 1 hour; RTO < 4 hours.
The recent security receipts.
Audits, pen tests and third-party reviews — the actual dates and the actual findings. We publish them because trust without documentation is just a feeling.
Mapped to the frameworks your auditor asks about.
Zinye's controls are explicitly mapped to the regulatory frameworks that govern modern businesses. We publish the mappings; your auditor or DPO can pull the evidence directly.
Six things we'll never do.
Sell your data. Ever.
Your transaction data isn't a product. It isn't training data. It isn't shared with advertisers. You're the customer — not the merchandise.
Hold your data hostage.
Export your full database any time, from the UI, in SQL, CSV or JSON. Standard schema. If you leave, we keep a copy for 60 days then permanently delete.
Move your data without consent.
The region you pick on signup is where your data lives. Migrating between regions requires written authorisation from your designated admins.
Hide a breach.
Material incidents are disclosed to affected customers within 72 hours, with a written post-mortem within 14 days. Always. Even when it's embarrassing.
Charge for security.
SOC 2, ISO 27001, encryption, backups, audit logs and MFA are in every plan. Security is the floor, not an upsell.
Ghost you in an incident.
Status page updates every 30 minutes during an incident. Real engineers, not bots. Status.zinye.com is public and uncensored.
Documents, on request.
The full evidence set is available behind a short security review — your name, your company, your reason. We reply within one business day. NDA already on file? You can pull the latest reports immediately.
Your security team's shortest
review, guaranteed.
Most enterprise security reviews close in under two weeks with Zinye. Our team has done hundreds; we know what your CISO is going to ask before they ask it.