Use only what is needed.
Scope a pilot to approved documents, devices, operators, and operational signals rather than collecting by default.
Security · Privacy · Trust
Keep the boundary explicit and the claims precise.
Zeah products emphasize data minimization, controlled inputs, local deployment options, and outputs that operators can review. Product-specific limits are stated alongside the capabilities they affect.
No analytics beaconCloudflare Web Analytics is disabled, with no third-party analytics or marketing trackers configured.
Synthetic demonstrationsNo real customer documents or camera feeds appear in product screenshots.
Evidence before assuranceCertifications and independent testing are stated only when supporting evidence exists.
Trust principles
Private software starts with fewer assumptions.
Process near the source.
Prefer local or private deployment paths when they fit the workflow, environment, and risk boundary.
Preserve reviewability.
Keep citations, event context, system state, provider details, and operator controls visible.
Product and research boundaries
Different inputs require different safeguards.
- Riftline Private AIApproved knowledge sets, source citations, permission-aware retrieval, auditable answers, and flexible local model architecture.
- SentryVisionExplicit camera inputs, local processing paths, controlled providers, camera-local tracking, defined geometry, and reviewable event history.
- Riftline SpatialApproved site evidence, hazards, routes, discrepancies, and confidence are kept reviewable; unverified observations cannot grant movement permission.
- Obsidian Reference PlatformDeterministic safety supervision and command authority remain separate from perception. AI detections never directly control motors.
Marketing-site privacy
A deliberately small surface.
- No third-party analytics or marketing trackers configured
- No external fonts or JavaScript libraries
- Cloudflare Web Analytics disabled
- No third-party form provider or external image host
- Contact requests stored in a locally hosted lead database
- No raw client IP stored in the lead database
- Resend used for contact-notification delivery
Demonstration integrity
Real UI. Safe data.
- Riftline Private AI demonstration documents
- SentryVision synthetic/mock source
- Riftline diagrams are conceptual research illustrations
- Obsidian is presented as a reference platform, not a production rover
- No real customer, employer, or security-camera data
- No credentials or internal URLs
Current assurance boundaries
Security still requires operating discipline.
Zeah does not currently advertise SOC 2, ISO, HIPAA, independent audit, or penetration-test assurance. The products still require access control, patching, operational ownership, review, and response planning.
- Access control and least privilege
- Patch and update ownership
- Environment-specific review
- Incident-response planning
- Human review of model outputs
- No life-safety assurance
- No guaranteed protection claim
- Local deployment options where appropriate
Responsible disclosure
A dedicated channel is not yet published.
Do not send vulnerability details through the general contact form; it is not a secure disclosure channel. Review the current guidance for safe handling and scope.
Read responsible disclosure guidance →Deployment boundary