Security
How we build and operate secure systems — and how to report a vulnerability to our security team.
Built to be defensible, not just functional.
The same eight principles shape every product we ship and every system we run for a client.
Security by Design
Threats are modelled while the architecture is still a drawing, not after the first incident.
Least Privilege
Every person, service and token gets the narrowest access that still lets the work happen.
Encryption
TLS in transit, encryption at rest where the platform supports it, and encrypted backups everywhere.
Audit Logging
Administrative and security-relevant actions are attributable: who did what, to what, and when.
Multi-Factor Authentication
Administrative access requires a second factor. A stolen password alone opens nothing.
Vulnerability Management
Dependencies are scanned continuously, and findings are triaged by real impact, not by score alone.
Regular Security Review
Architecture, permissions and access lists are reviewed on a schedule, not only after a change.
Secure SDLC
Review, automated tests, secret scanning and signed artefacts are release gates, not recommendations.
In brief: security is a design constraint at Z-SOFT, not a review step at the end. This page describes how we build and operate, and how to report a vulnerability to us.
Last updated: 31 July 2026
How we build
- Threat modelling before code. Every significant feature starts with what it exposes, who can reach it and what happens when a control fails.
- Review and automation in the pipeline. Changes are peer-reviewed and pass automated tests, dependency and secret scanning before they can be released.
- Isolation by default. Tenants, sites and extensions are separated at the data layer, and extension code runs sandboxed with an explicit, declared set of permissions.
- Signed, verifiable artefacts. The packages our platform installs are cryptographically signed and verified before they run, so what we published is what executes.
- Secrets stay out of the repository. Credentials live in a secret store, are scoped to one environment and are rotated when someone's access changes.
How we operate
- Encryption. Traffic is served over TLS with modern ciphers; stored data is encrypted at rest where the platform supports it, and backups are encrypted wherever they live.
- Access control. Administrative access is least-privilege, individually attributed and protected by multi-factor authentication. Access is reviewed when a role changes and revoked when it ends.
- Audit logging. Administrative and security-relevant actions are recorded with actor, target and time, so an incident can be reconstructed rather than guessed at.
- Backups you can restore. Backups are automated and — the part that matters — periodically restored and verified, because an untested backup is not a recovery capability.
- Monitoring and response. Availability, error and security signals are monitored; incidents follow a defined path from detection through containment, recovery and a written review.
- Patching. Dependencies and infrastructure are updated on a regular cadence, and out of cadence when a vulnerability warrants it.
Your data, and AI
Customer data belongs to the customer. We do not sell it, and we do not use customer content to train public AI models without explicit agreement. Where a product uses an AI model, the data sent to it, the retention that applies and the human review around it are described in that product's documentation and in the agreement covering it.
Responsible disclosure
If you have found a vulnerability in a Z-SOFT website, product or service, we want to hear from you before anyone else does.
How to report
Email security@z-soft.com.vn with enough detail to reproduce the issue: the affected URL or component, the steps, what you obtained, and any proof-of-concept. English, Vietnamese and Japanese are all fine.
What we ask of you
- Do not exploit the issue beyond the minimum needed to demonstrate it.
- Do not access, modify, delete or retain data that is not yours — stop as soon as you can prove access, and tell us what you saw.
- Do not run denial-of-service tests, spam, social engineering or physical attacks against our staff or providers.
- Give us reasonable time to fix the issue before disclosing it publicly, and coordinate the timing with us.
- Comply with applicable law while you research.
What we commit to
- We acknowledge your report within 72 hours.
- We assess it, tell you our conclusion and keep you informed while we work on a fix.
- We do not pursue legal action against researchers who follow the rules above and act in good faith.
- We credit you when the fix ships, if you would like to be named.
Usually out of scope
Reports produced solely by an automated scanner with no demonstrated impact; missing hardening headers or best practices without a working attack; issues that require a compromised device, a rooted browser or a physically present attacker; and vulnerabilities in third-party services we do not operate. Send them anyway if you can show real impact — impact is what we judge on.
Contact
Security reports: security@z-soft.com.vn. Everything else: contact@z-soft.com.vn.
Found something? Tell us first.
Send the details to security@z-soft.com.vn. We acknowledge every report within 72 hours and keep you informed until it is fixed.