Security and your data

A shop's data is the shop's

Harnesses, revisions, quotes, price lists, labour tables and printer corrections belong to an organisation. Only its members see them: every request for a shop's data checks the organisation before anything is read or written.

Nothing a shop enters is public. There is no shared parts pool built from customers' drawings.

Export and deletion

A project can be taken out at any time, in full: as a .zwire file with its revision history, as CSV (cut list, BOM) and as PDF (quote, formboard, production pack). A .zwire file is plain JSON, readable without Zorowire.

A deleted project goes to “Recently deleted” for 30 days, where its owner can restore it; after that it is purged with all its revisions. Quotes already issued keep their own frozen copy.

Deleting your account closes it at once: no sign-in, API key or webhook works any more. The projects, quotes, price lists and printer settings of an organisation you ran alone are deleted for good after 30 days (until then we can bring them back if you write to us). A team's organisation keeps its projects for the other members. Billing records are kept, as accounting law requires.

Signing in

• Passwords are stored only as Argon2id hashes (64 MiB of memory, three passes). Signing in by an e-mail link needs no password at all.
• A passkey can replace the password, and an authenticator app (TOTP) adds a second factor. Authenticator secrets are encrypted at rest with AES-256-GCM under a key of their own; recovery codes are stored only as hashes, and a code cannot be used twice.
• The session cookie is HttpOnly, Secure and SameSite=Lax. The account page lists every signed-in device, and each can be signed out.
• Sign-in, sign-up and password reset are rate-limited.

Zorowire staff

The team's back office needs a second factor, and every change made there needs a fresh proof of identity from the last ten minutes. Each such change is written to an audit log.

Payments

Payments are taken by Stripe on its own checkout page. Card details go to Stripe; Zorowire never receives or stores a card number.

Backups

The database is dumped every night and each dump is kept for 14 days on the server. An encrypted copy off the server, which the server itself could not decrypt, and an alert for a night whose backup fails are being set up; this page will say when they run.

The website

The site loads no third-party scripts unless you accept analytics cookies, and a strict Content Security Policy limits what a page may load or send. The Workspace runs in your browser; signed out, a draft stays in this browser only.

Search engines and AI assistants

Our public pages — product, pricing, guides, comparisons, reference data — are open to search engines and AI assistants, including the crawlers that collect text for training models. We would rather be quoted correctly than not at all.

We name each crawler we allow in our robots.txt: OpenAI's OAI-SearchBot, ChatGPT-User and GPTBot; Anthropic's Claude-SearchBot, Claude-User and ClaudeBot; PerplexityBot and Perplexity-User; Google-Extended; Applebot and Applebot-Extended; and Common Crawl's CCBot. Bytespider is not allowed, because we found no documentation from its operator about what it collects or how it treats robots.txt.

Nothing a shop enters is public. Harnesses, quotes, drawings and uploads sit behind sign-in or expiring links and are never indexed, whatever robots.txt says.

robots.txt →llms.txt →

Reporting a problem

Found a security problem? Write to [email protected]. We answer every report and say what we changed.