SECURITY OVERVIEW — NOT A CERTIFICATION

Security at Zambo

Last updated: September 14, 2026. This page states the controls Zambo currently operates. It does not claim SOC 2, ISO 27001, penetration-test certification, or a guarantee of absolute security.

Transport and access

Public service traffic is served over HTTPS in production. The free MCP endpoint does not require an account or API key. Paid access uses a server-issued capability key or a verified payment flow; access should not be inferred from an email address alone. Rate limits and abuse controls are applied to protect shared infrastructure.

No stored credentials

Zambo does not ask for or store user passwords, private keys, or seed phrases. Users remain responsible for reviewing requests and confirming wallet transactions. Do not submit credentials or secrets in a job.

Receipts and integrity

Tool executions return receipts keyed by a UUID with timestamps, status, and a SHA-256 hash. The hash helps detect changes to the recorded receipt payload; it is not independent proof that an external fact, payment, or tool result is true. Payment activation requires verification of the relevant transaction before access is enabled.

Abuse controls

Zambo uses quota enforcement, rate limits, request validation, provider timeouts, and monitoring to reduce abuse and cascading failures. External-provider results can be unavailable; the service should return an unavailable or failed status instead of inventing a result.

Data handling

Requests and operational records are processed only as needed to execute requested features, return receipts, secure the service, and handle payments or support. See the draft DPA for the current data-processing description. Public URLs, repositories, and blockchain transactions may be visible to third parties independently of Zambo.

Report a concern

Send a security report to brennanzambo@zambo.dev. Do not include secrets in a report. Please provide the affected URL or behavior, reproduction steps, impact, and a safe way to follow up.