Last updated November 4, 2026
Zerf builds and maintains software for clients in hospitality and travel. This page describes the security practices we follow today to protect our clients’ data and systems. Our commitments to each client are set out in that client’s Master Services Agreement.
Encryption
- Data in transit is encrypted with TLS 1.2 or higher, and our website uses HTTP Strict Transport Security (HSTS).
- Data at rest is encrypted by our cloud providers, including DigitalOcean, Supabase and Vercel.
Access control
- Access follows least privilege: people get only the access their work requires.
- Everyone uses an individual account. We do not share accounts.
- Multi-factor authentication or an equivalent secure sign-in is required on our cloud, code and identity systems.
- Access is removed promptly when someone leaves a project or the company.
Devices
Our team works on company-managed laptops with full-disk encryption and endpoint monitoring.
Secure development
- Code changes are peer-reviewed before they are merged.
- Production branches are protected against direct changes.
- We scan dependencies and code for known vulnerabilities.
People
Everyone on the team completes security awareness training and accepts our security policies when they join and every year after.
AI tools
We use AI tools only with providers configured for zero data retention and with no training on client data.
Incident response
We maintain an incident response process. If we confirm a security incident that affects a client’s data, we notify that client within 72 hours.
Responsible disclosure
If you believe you have found a security vulnerability in our website or in a system we operate, please email security@zerf.tech with enough detail for us to reproduce it. Please give us reasonable time to investigate and fix the issue before sharing it publicly, and do not access, change or delete data that is not yours while testing. We will acknowledge your report and keep you informed.
Compliance
We are working toward a SOC 2 audit. Clients and prospective clients can request our security documentation at security@zerf.tech.
Contact
Security questions and reports: security@zerf.tech. For how we handle personal information collected through this website, see our Privacy Policy.