SECURITY & SOVEREIGNTY
Your data, your servers.
ZRO is the sovereign alternative to US cloud construction platforms. Self-hostable anywhere in the world. Your infrastructure, your jurisdiction, your data.
SOVEREIGNTY PILLARS
Six principles. No compromise.
01
SELF-HOST
Run it on your own hardware
Docker Compose and Kubernetes manifests for full on-premise deployment. Air-gapped installations supported. No internet dependency required after setup.
02
SWISS nFADP
New Federal Act on Data Protection
ZRO is built to comply with the Swiss nFADP. Data processing agreements, data minimization, and purpose limitation are built into the platform architecture.
03
GDPR
EU General Data Protection Regulation
Full GDPR compliance for EU customers. Data portability, right to erasure, and consent management are native platform features.
04
ENCRYPTION
AES-256 at rest, TLS 1.3 in transit
All data encrypted at rest with AES-256. All connections enforce TLS 1.3. No plaintext data at any point in the pipeline.
05
AUDIT LOGGING
Every action, append-only
Every write operation and every access to sensitive data is logged in an append-only audit trail. Exportable for compliance review.
06
SOVEREIGN AI
Local models, no foreign dependencies
A sovereign local AI model handles text reasoning and vision — one model, no cloud dependency. No prompts, no context, no project data ever sent to third-party AI providers.
CONTROLS
Every control, documented.
DATA RESIDENCY
Your data. Your region. Your jurisdiction.
All managed ZRO instances store data in Swiss data centers. No replication to US servers, ever. Enterprise customers can self-host on their own infrastructure for full air-gapped sovereignty.
Every AI feature runs on your own infrastructure. No prompts leave your environment. No project data is sent to OpenAI, Google, or any other third-party lab.
SOVEREIGNTY MATRIX · WHAT'S WHERE
We don't claim 100% sovereign — we tell you exactly which seams aren't.
Most "sovereign EU" vendors have non-EU dependencies they don't disclose. Here's the unfiltered map of what runs where on our stack today, so you can decide if it fits your DPA.
All Non-EU and Mixed dependencies are switchable on Enterprise: we publish the swap list (Bunny.net for CDN, Stripe Connect EU for payments, self-hosted MTA for email, fully-disabled fallback AI) so your DPA can be 100% EU-resident on day one.
CONTACT
Talk to the security team.
Security questionnaires, penetration tests, architecture reviews, and self-host discussions. Direct line to our engineers.
Contact security