No full card storage
Zropics never stores full PAN or CVV, and UI copy blocks users from entering it.
Trust Center
Zropics is resilient, monitored, segmented, encrypted, and built around aggressive data minimization.
Zropics never stores full PAN or CVV, and UI copy blocks users from entering it.
Normalized identifiers are matched with keyed HMAC-SHA256 blind indexes.
Display labels, summaries, webhook endpoints, and notes use AES-GCM metadata encryption.
Lawful datasets land in quarantine storage and are processed by workers, not long Vercel requests.
Raw uploads are purged according to tenant retention after safe indicators are extracted.
Sensitive billing, bank, ops, privacy, and export actions create audit records.
Bank webhooks include timestamped HMAC signatures and idempotency controls.
Fake admin routes and honeytoken hits create security events without exposing real systems.