How we secure our own operations and handle your data
We hold ourselves to the standard we run for clients. This page says what we do, which providers touch your data, how to report a weakness, and where we stand on certifications, including the ones we have not earned yet. Where a line needs evidence, ask for it.
Our own security posture
The ten controls every managed client gets on day one are the controls we run on ourselves. These are the ones that matter most to a client whose environment we can reach.
Phishing-resistant MFA for our staff
Security keys or passkeys on every administrative account, number-matching MFA everywhere else, legacy authentication blocked.
Managed, encrypted devices
Every company device is enrolled, disk-encrypted, patched on our published cadence and protected by the same endpoint detection and response we operate for clients.
Least privilege to client systems
No standing administrator access. Elevation is just-in-time, approved, logged and reviewed quarterly, and admin work happens from separate hardened workstations.
Monitored like a client
Our own estate and this website feed the same security operations centre that watches client environments, around the clock.
Backups we have restored
Immutable, verified backups of our own systems, with restore tests on the same quarterly rhythm we hold clients to.
Providers reviewed before use
Every third party that touches client data is reviewed before it is used and is listed on this page or in the relevant service agreement.
Certifications and audits: where we stand
Badges are easy to print and hard to verify. This table says exactly what we hold, what we do not, and what each line means for you. Nothing here is shown before it has been earned.
| Standard | Where we stand | What it means for you |
|---|---|---|
| SOC 2 Type II | Not yet held | We map our internal controls to the Trust Services Criteria and provide control descriptions under NDA. When an independent report is issued, it will be published here. |
| ISO 27001 | Not yet held | Our security management follows the standard's control set. We do not describe ourselves as certified until an accredited auditor has said so. |
| PCI DSS v4.0 | Not in scope for us | We do not store, process or transmit cardholder data on behalf of clients. We help clients scope, segment and evidence their own PCI DSS compliance. |
| HIPAA | No certification exists | A United States law with no certifying body. For clients handling US health data we apply the Security Rule safeguards and sign the required agreements. |
| PIPEDA and BC PIPA | Applies to us directly | Canada's federal privacy law and British Columbia's provincial law. We run a privacy programme under both with a named Privacy Officer. Requests are answered within 30 days. |
| Vendor certifications | Held by our engineers | Current credentials on the platforms we design and operate. We list them by engineer in proposals rather than as a logo wall. See the Credentials page. |
Policies, control descriptions and a sample monthly service report are available to clients and prospects under NDA. Email ask@zerodayit.ca with the documents you need.
Privacy and data handling
The short version of our Privacy Policy, which governs if the two ever differ.
Canadian company, Canadian law
We operate under PIPEDA and British Columbia's PIPA. Our Privacy Officer answers access, correction and deletion requests within 30 days at ask@zerodayit.ca.
Client data stays where you agreed
Residency and retention for service data are set per service and written into your agreement. Nothing moves to a new provider or region without a written change you have seen.
This website keeps very little
No analytics or advertising cookies and no tracking scripts. Form submissions arrive by email. Tool inputs are not retained. Abuse-prevention counters expire within 24 hours.
Encryption and access
TLS in transit, encryption at rest, MFA and least privilege for our staff, and a mutually authenticated connection between this website and our AI infrastructure.
ZeroBot, the advisor on this site
ZeroBot answers security and IT questions using an AI model that runs on infrastructure owned and operated by Zero Day IT in Canada. Your messages are not sent to a public AI service, are not used to train any model, and are not stored after the reply is generated. Every answer carries a "Report this answer" link; reports go to a person, and corrections are made to the facts ZeroBot is given, not buried. Please do not paste credentials or confidential data into any chat tool, including ours.
Providers behind this website
Every third party that may process information about a visitor to zerodayit.ca. Providers used to deliver managed services to a client are listed per service in that client's agreement, and we tell clients before adding one that will touch their data.
| Provider | Purpose | Data involved | Location |
|---|---|---|---|
| Vercel | Hosting this website and its request logs | IP address, pages requested, timestamps | United States |
| Google Workspace | Delivering contact-form messages to our team by email | Name, email, phone, company, your message | Google data centres, primarily United States |
| Upstash | Short-lived abuse-prevention counters for forms and chat | A counter keyed to an IP address or submitted email; expires within 24 hours | United States |
| ip-api.com | Geolocation for the public-IP panel, only when you use it | Your public IP address; result not stored by us | Varies by request |
Public threat feeds (for example CISA) are fetched by our server; nothing about you is sent to them. The dark-web exposure check compares the domain you enter against a public breach catalogue on our server and does not send the domain to any third party.
Responsible disclosure
Found a weakness in our systems or this website? Email security@zerodayit.ca. We acknowledge within two business days, keep you informed until it is fixed, and will not pursue good-faith research that respects privacy and avoids disruption. We do not run a paid bounty programme.
Service targets we publish
The standard targets every managed client is measured against. Attainment is reported to each client every month in their service report. We do not publish aggregate attainment figures here, because a number without its context is marketing.
The full priority table, escalation path and operating cadence are on the Services page.
Documents
This page was last reviewed on October 29, 2026.