What Zone51 protects automatically.

You describe your app. Zone51 works out what kind of information it will handle and adds the protections that fit — you don't have to ask, and you don't need to know security words.

Every app

• Pages come with security headers, and published apps run over HTTPS.
• Keys and passwords stay on the server — never in the page people download.
• Text people type is shown as text, never run as code.
• Zone51 checks your app's code for mistakes like keys written into it, and checks its building blocks for known problems.

Apps with accounts

• Passwords are stored properly (never readable), sign-ins expire and can be ended from every device, and repeated wrong guesses are slowed down.
• People can only see and change their own data — the server checks this every time, not just the screen.
• Teams and companies get roles, and their data is kept separate from everyone else's.
• People can export or delete their data.

Apps that use AI

• Only what a task needs is sent to the AI service, with names, emails and account numbers removed or replaced.
• Documents, emails and websites are treated as information, never as instructions to the AI.
• An AI assistant can only do the specific things it was allowed to, and risky actions — sending messages, deleting things, moving money — wait for a person to approve them.

Before you publish

Zone51 scans your app again. If it finds a critical problem, it stops the publish, explains it in plain words, and can fix it for you and publish again. Every app gets a security report in its Security tab.

What Zone51 can't promise

Zone51 automatically implemented the security controls identified for this application's architecture. Additional legal, regulatory, infrastructure, or organizational requirements may apply depending on how the application is used and deployed.

No tool can make software perfectly secure. If your app handles health, financial or identity information, have it reviewed before real people use it.

Zone51 itself

• Your password is stored as a salted one-way hash; signing out really ends the session, and a password reset signs out every device.
• You can turn on 2-step verification in Settings: signing in then also needs a 6-digit code from an authenticator app, with one-time recovery codes in case you lose your phone.
• The keys and database addresses you save in Backend are stored encrypted, and never sent to the AI model.
• Your apps are built and run in isolated containers with no route to our systems or to other customers' apps.
• Settings shows your account's recent security activity. See also the Privacy Policy.