We're built for teams that can't afford to get security wrong.
You choose the access level. SOC 2 Type II and ISO 27001 certified. Every change logged with who made it, when, and what happened.
A security posture built for regulated infrastructure.
zopnight is designed from first principles for enterprises that can't afford a breach, a leak, or an audit surprise. You decide how much access it gets, and every change it makes is on the record.
Access you choose
Discovery, cost and recommendations run on read access. Start/stop and remediation need write permissions, which you grant explicitly when you connect and can revoke at any time from your cloud console, no call required. The exact roles for each cloud are listed below.
What we store
We store the resource metadata, tags, configuration, cost history, usage metrics and activity we need to run the product, no application data. Discovery runs when you connect an account and every 6 hours after that. When you disconnect an account, its credentials are deleted from our vault.
Audit trail
Every change made in zopnight, by a person, the API or an AI assistant, is logged with actor, time and outcome, and can be exported as CSV.
RBAC + SSO
Role-based access control is enforced at every layer. Viewer, Editor, and Admin roles map cleanly to least-privilege. Sign in with SAML 2.0 single sign-on, Google or GitHub.
Encryption at rest & transit
Data in transit uses TLS. Your cloud credentials are encrypted with AES-256-GCM in our vault, and our databases are encrypted at rest by our cloud provider.
Compliance you can reference in your own audits.
Our certification posture is designed to reduce your compliance burden, not add to it. We maintain current certifications and publish our reports on request.
SOC 2 Type II
Our SOC 2 Type II report covers Security, Availability, and Confidentiality trust service criteria. Audit period: trailing 12 months. Report available under NDA to enterprise prospects.
ISO 27001
ISO 27001 certification covers our information security management system (ISMS) across all product and infrastructure operations. Certificate available on request.
The exact permissions we ask for.
On AWS, zopnight connects through a CloudFormation stack that creates one IAM role. The role trusts zopnight through OIDC web identity federation, so there are no long-lived access keys to hand over.
The role always gets the AWS-managed ReadOnlyAccess policy plus three zopnight read policies that list every read action explicitly. ReadOnlyAccess includes object reads in S3, which zopnight uses to read your billing export. If you connect read-write, the role also gets ZopNightWritePolicy (scheduling actions such as start and stop) and ZopNightRemediationPolicy (remediation actions, some of which delete resources).
The connect flow sets the stack's PermissionLevel parameter from the access level you pick; the template's own default is read_write. Read the full template: zopnight-role.yaml.
On Azure, read access uses the built-in Reader and Cost Management Reader roles. Kubernetes and Databricks use the custom Zopnight AKS Access and Zopnight Databricks Access roles, and start/stop and remediation add the custom Zopnight Write Access role.
On GCP, zopnight uses predefined roles. Discovery and cost use viewer roles such as Compute Viewer, Cloud Asset Viewer, Monitoring Viewer and BigQuery Data Viewer. Some features, plus start/stop and remediation, need broader roles such as Compute Instance Admin, Kubernetes Engine Developer, Storage Admin and Notebooks Admin. The connect flow lists every role for each cloud and what it is used for.
Permission changes are announced in the changelog.
ZopNightRole:
AssumeRolePolicyDocument:
# OIDC web identity, no access keys
Action: sts:AssumeRoleWithWebIdentity
ManagedPolicyArns:
- arn:aws:iam::aws:policy/ReadOnlyAccess
- ZopNightReadPolicyA # every catalogued read, listed
- ZopNightReadPolicyB
- ZopNightReadPolicyC
# only when PermissionLevel=read_write:
- ZopNightWritePolicy # start, stop, scale
- ZopNightRemediationPolicy # remediation, incl. deletesSecurity and legal documentation.
Every document you need for security review, procurement, and compliance, in one place.
Privacy Policy
What we collect, why we collect it, how long we keep it, your rights, and how to contact us.
→Terms of Service
How you may use the zop.dev website, disclaimers, liability limits, and how these terms change.
→Service Status
Live status and 90-day uptime for every zopdev service, updated as incidents open and close.
→Refund Policy
How billing works, refund eligibility, the request process, and cancellation.
→Security issues? We want to know.
zopnight undergoes annual third-party penetration testing by an independent security firm. We publish our most recent pentest summary (executive findings only, not the full report) to enterprise customers under NDA.
We also operate an ongoing responsible disclosure program. If you find a vulnerability in any zopnight product or infrastructure, we want to hear about it before anyone else does. We will never pursue legal action against good-faith researchers.
To report a vulnerability: email support@zop.dev with a description of the issue, steps to reproduce, and any supporting evidence.
We do not currently operate a bug bounty program, but we recognize significant findings with public credit (with researcher consent) and may offer discretionary rewards at our security team's determination.
Contact our security team
| Milestone | Commitment |
|---|---|
| Initial acknowledgement | Within 48 hours |
| Initial severity assessment | Within 7 days |
| Critical vulnerability patch | Within 14 days |
| High vulnerability patch | Within 30 days |
| Researcher notification | Before public disclosure |
See the full security documentation.
Talk to our security team.
Enterprise customers get direct access to our security engineering team, pentest reports under NDA, and a dedicated trust review before onboarding.