Privacy policy.
The short version: authorization decisions run inside your infrastructure, your request data stays with you, and we collect the minimum we need to run the control plane.
EFFECTIVE JULY 4, 2026 · APPLIES TO THE ZSTRIKE CLOUD BETA
Account data. Name, work email, company, and password hash when you create an account; billing details if you buy a paid plan.
Control-plane metadata. Your Cedar policies, entity schemas, sync configuration, policy version history, and the operational logs the dashboard shows you.
Product telemetry. Feature usage events and error reports from the dashboard and CLI, tied to your account, so we can fix what breaks.
What we do not collect by default. Authorization requests are evaluated by sidecars inside your infrastructure. The principals, resources, and context of your requests are not sent to ZStrike Cloud unless you explicitly enable decision-log shipping.
To operate and secure the service, to support you, to improve the product, and to send service and product emails you can opt out of.
We do not sell your data, we do not use it for advertising, and we do not train models on your policies or entities.
Control-plane data is hosted with major cloud providers in the United States, encrypted in transit (TLS 1.2+) and at rest (AES-256).
Operational logs are retained for 30 days during the beta. Account data is retained while your account is active and deleted within 30 days of a verified deletion request.
We share data only with the subprocessors that run the service — cloud hosting, transactional email, error tracking, and payments — under data-processing agreements. A current list is available on request.
We disclose data if the law requires it, and we will tell you when we're allowed to.
You can access, export, correct, or delete your data at any time — from the dashboard or by emailing us. If you're in a jurisdiction with stronger rights (GDPR, CCPA), we honor those too.
Questions or requests: privacy@zstrikehq.com.
This policy will evolve as the beta does. We'll email account owners about material changes at least 14 days before they take effect, and the version history stays public.