Privacy policy.
The short version: we collect what we need to run ZStrike, we don't sell it, and we don't train models on your policies or entities.
Effective October 2, 2026 · applies to ZStrike Cloud
Account data. Name, work email, company, and password hash when you create an account; billing details if you buy a paid plan.
Control-plane metadata. Your Cedar policies, entity schemas, the entities you sync, sync configuration, policy version history, and the operational logs the dashboard shows you.
Authorization data. When a decision engine hosted by ZStrike evaluates a request, we process the principal, action, resource, and context of that request, and we keep the decision record for your plan's audit retention period. A self-hosted engine evaluates requests inside your infrastructure and sends decision records to ZStrike only when decision-log shipping is enabled.
Product telemetry. Feature usage events and error reports from the dashboard and CLI, tied to your account, so we can fix what breaks.
Site and contact data. What you send us through the contact form or by email, and standard request logs from this website.
To operate, secure, and bill for the service, to support you, to improve the product, to enforce our terms, and to meet legal obligations. We send service emails as needed, and product emails that you can opt out of. We may use aggregated, de-identified data for analytics and to improve the service.
We do not sell your data, we do not use it for advertising, and we do not train models on your policies or entities.
Control-plane data is hosted with major cloud providers in the United States, encrypted in transit (TLS 1.2+) and at rest (AES-256).
Decision records are kept for your plan's audit retention period. Account data is kept while your account is active. After a verified deletion request we delete it within 30 days, except data we must keep for legal, billing, or security reasons. Backups may keep copies for a limited period.
We share data only with the subprocessors that run the service — cloud hosting, transactional email, form handling, error tracking, and payments — under data-processing agreements. A current list is available on request.
We disclose data when the law requires it or to protect the service and our rights, and we tell you when we're legally allowed to. If ZStrike is acquired or merges with another company, your data may transfer to the successor under this policy.
You can ask us to access, export, correct, or delete your data by email. We verify each request before we act on it. If the law where you live gives you additional rights, we honor them.
Questions or requests: privacy@zstrikehq.com.
We may update this policy. We'll email account owners about material changes at least 14 days before they take effect, and continued use after that date means you accept the updated policy.