Trust
Security practices
The mechanisms that protect your account, your PC and your data. They describe how AI Zeny works; they are not a guarantee that nothing can go wrong.
Portal sign-in
- Portal passwords have at least 12 characters. When an organization registers, the administrator confirms a one-time code sent to their email address and another sent to their WhatsApp number before the workspace opens.
- The portal session is held in a cookie that the website’s pages cannot read with JavaScript.
- Changing the password while signed in signs out the account’s other sessions; resetting a forgotten password with a one-time code signs out every session.
API tokens
- Each token is shown once, can be limited to selected companies and can expire; rotation keeps the old token working for an overlap you choose (none to 60 minutes), and revoking stops it at once.
- The API accepts a token only in the Authorization header — never in a request body or query string — and the token never reaches your PC.
Your PC and the relay
- A PC is linked to your organization with a one-time enrollment code that expires and works once; you can revoke the PC in the portal, which stops AI Zeny on it at once.
- A request relayed through the AI Zeny API reaches your PC as a signed command, announced through your organization’s own Pusher Channels app (a command too large for one Pusher event is fetched by the PC from AI Zeny). AI Zeny stores the Pusher app secret encrypted and never shows it again.
- The AI Zeny app on the PC opens only with a local password or PIN created there; it is not your portal password and the app does not send it anywhere.
- A SQL Server password you enter in the Windows app is stored encrypted on that PC only.
Cloud mode
- Snapshots are stored encrypted, and access to them is tied to your organization’s authentication and API tokens.
Local API
- The Local API refuses requests from addresses outside the PC and private local-network ranges, and the Windows firewall rule AI Zeny creates admits the local subnet only, on Domain and Private profiles. Your own network and firewall settings remain yours to manage.
- It uses its own token, generated on the PC and never sent to the cloud; regenerating it stops the old one immediately.
The Windows app
- The installer is not code-signed, so Windows shows it as coming from an unknown publisher.
- The app checks each automatic update’s integrity before installing it; this is separate from code signing.
Your responsibilities
- Scripts are stored and run in the AI Zeny Windows app on your PC — also when you use Cloud mode — whether you write them yourself or the AI agent drafts them. Inactive scripts can run for previews and tests, and those runs have real effects; API use requires you to activate the script. Scripts are not sandboxed; you are responsible for what they do.
- Keep API tokens in a secret manager, one per system; see keeping your API tokens safe.
- Keep the PC that runs AI Zeny, its Windows accounts and your network secure.
Not published yet
How long snapshots and account records are kept, and backup practice; The contracted email and WhatsApp code-delivery providers and their processing locations; A dedicated security-reporting channel or disclosure programme — none of these is stated until it has been published. AI Zeny claims no security certification, audit or compliance status.