Security at Zeyto - how your data is protected

Your data stays with you

Zeyto runs on your own Windows PC, server or private cloud, with its own database. Invoices, ledgers, stock, customers and salaries are stored there - not on our servers - and the software keeps working when the internet is down.

Our cloud services hold your licence record, your portal account (name, e-mail, company) and, only if you switch it on, backup copies.

Licences

Every licence file is digitally signed (Ed25519). Your installation checks the signature, so a licence cannot be edited or forged to unlock modules, users or devices.

Accounts and passwords

Customer portal passwords are stored only as salted PBKDF2-SHA256 hashes - we cannot read your password.
Your portal login and your Zeyto login are separate. Signing in to the portal never gives access to your books on its own.
Sign-in and public forms are rate-limited to slow down password guessing and automated abuse.

Remote access from outside the shop

Your Zeyto server connects out to our relay; no port has to be opened on your router.
Opening your system remotely needs two separate sign-ins: your portal account (which proves you own the licence) and your own Zeyto username and password, which your server checks itself.
Remote sign-ins and requests are rate-limited, and the shop administrator can revoke a shared link or a paired PC at any time.

Website and portal

zeyto.app is served only over HTTPS, with HTTP Strict Transport Security.
Forms collect only what is needed to reply to you; see the Privacy Policy for what we store and why.

Reporting a security issue

If you think you have found a security problem in Zeyto, the portal or this website, e-mail info@emeron.io with the steps to reproduce it. Please do not access other customers' data or disrupt the service while testing, and give us a reasonable time to fix the issue before sharing it publicly.

We will confirm we received your report and keep you updated while we investigate.