Trust

Evidence you can re-run.

Zdravo sits between AI agents and the actions they ask to take, so it is held to a higher bar than the tools it governs. Each result below comes from a verifier script, most of them read-only queries against the production database, and shows when it was captured and the command that captures it again. Failing checks are shown as failing.

Verification results

Captured against the production project and the commit shown. A result is only as current as its capture time.

Tenant isolation

Row-level security is on for every public table; no always-true row filter, anonymous write grant or unfiltered authenticated mutation reaches an end-user role.

5/5 pass

Captured: 2026-10-27 19:25 UTC
Commit: 99ccdbca4
Target: zxibljbvgenwskjjkkdf

Checks and re-run command

passrls_enabled_on_every_public_table
passno_always_true_filter_for_end_user_roles
passno_write_privileges_for_anon
passno_unfiltered_authenticated_mutation
passapi_layer_no_anonymous_reads

node scripts/verify-tenant-isolation.mjs

Database privilege hygiene

Anonymous callers cannot reach the public schema, hold no write privileges, and every browser-executable SECURITY DEFINER function is reviewed; every migration in the repository is recorded in production.

5/5 pass

Captured: 2026-10-28 03:48 UTC
Commit: d98fa726d
Target: zxibljbvgenwskjjkkdf

Checks and re-run command

passanon_cannot_reach_public_schema
passanon_has_no_table_write_privileges
passauthenticated_has_no_truncate_references_trigger
passno_browser_executable_security_definer_functions
passlocal_migrations_all_recorded_in_production

node scripts/verify-p0-closure.mjs

Policy and privilege consistency

Every row policy for signed-in users has the table privilege it needs, and no route asks the database for a verb the session role does not hold.

4/4 pass

Captured: 2026-10-27 19:26 UTC
Commit: 99ccdbca4
Target: zxibljbvgenwskjjkkdf

Checks and re-run command

passlive_policy_privilege_rows_captured
passevery_end_user_policy_has_its_privilege
passauthenticated_can_reach_public_schema
passno_session_role_query_with_denied_verb

node scripts/check-rls-privilege-consistency.mjs --live

Browser-callable database functions

Every function a browser role may execute is listed with a written justification, and the list matches what production grants.

6/6 pass

Captured: 2026-10-27 19:38 UTC
Commit: 8607ced3e
Target: zxibljbvgenwskjjkkdf

Checks and re-run command

passlive_database_browser_grants_captured
passno_unlisted_browser_rpc
passbrowser_grants_match_allowlist_roles
passno_stale_allowlist_entries
passallowlist_entries_name_real_functions
passno_duplicate_allowlist_declarations

node scripts/check-rpc-allowlist.mjs --live

Transport and browser controls

Nonce-based CSP, exact-origin CORS, framing denial and no-store on authorization responses, measured on what zdravo.ai serves.

9/9 pass

Captured: 2026-10-28 02:14 UTC
Commit: 2068c0fae
Target: https://zdravo.ai

Checks and re-run command

passhtml_pages_carry_a_nonced_csp
passapi_responses_carry_a_nonced_csp
passroute_owned_csp_is_not_replaced
passunenumerated_subdomain_gets_no_credentialed_cors
passunrelated_origin_gets_no_credentialed_cors
passfirst_party_origin_still_gets_credentialed_cors
passauth_endpoint_responses_are_not_cacheable
passauth_code_callback_is_not_cacheable
passbaseline_headers_present

npm run verify:headers

Service objectives and audit chain

Latency and error metrics are recorded, the hash-chained audit log verifies for every organization, and erasure cascades complete.

8/9 pass

Captured: 2026-10-27 19:27 UTC
Commit: 99ccdbca4
Target: zxibljbvgenwskjjkkdf

Checks and re-run command

passslo_2_1_latency_sli_is_instrumented
passslo_2_2_error_rate_sli_is_instrumented
passslo_2_3_decision_throughput_within_budget
passslo_2_3_policy_latency_and_denial_rate_measured
passslo_2_4_audit_hash_chain_verifies
failslo_2_4_kms_signatures_verifiable
passslo_2_5_cascade_completion_rate
passslo_2_5_cascade_dead_letter_rate
passslo_2_5_expired_lease_rate

node scripts/verify-slos.mjs --live

Scheduled jobs

Database jobs are reproducible from migrations, hold no literal credentials, complete their runs, and their failures are observed.

3/7 pass

Captured: 2026-10-27 19:26 UTC
Commit: 99ccdbca4
Target: zxibljbvgenwskjjkkdf

Checks and re-run command

failjob_definitions_are_reproducible_from_the_active_migration_chain
passno_literal_credentials_in_job_definitions
passscheduled_http_calls_target_production
failscheduled_http_delivery_succeeds
faildelivery_evidence_window_covers_daily_schedules
passevery_active_job_has_a_completed_run
failfailed_job_runs_are_observed

node scripts/verify-scheduled-work.mjs --live

Verify a decision without trusting us

Every governed action gets a decision. Allow, deny or hold for a person, with the policy that decided it, recorded before the action runs.

Decisions are signed. A decision receipt is a compact JWS signed with ES256 by a Google Cloud KMS key; the private key never leaves KMS. Arguments appear only as a SHA-256 hash.

Keys are public. Verify a receipt you hold against the published keys, ideally pinned out of band: /api/receipts/keys.

Audit events are hash-chained per organization. In the latest service-objectives capture above the chain verifies for every organization, with four historical rows accepted by exact id after owner review; any other break fails the check.

Third-party services

Services the production deployment is configured to use, and the data each receives. The contractual sub-processor list will be part of the DPA, which is under counsel review.

Service	Purpose	Data it receives
Vercel	Application hosting and edge network (US)	All request traffic, including API calls and session cookies
Supabase	Postgres database, authentication and file storage (AWS us-west-2)	Account data, organization data, memories (organization memories envelope-encrypted), audit and decision records
Google Cloud	Cloud KMS signing key for decision receipts and audit events; Cloud Storage for audit-chain anchors; Google sign-in	Hashes and signatures (no memory content) for KMS and anchors; name and email for Google sign-in
ngrok	Tunnel (HTTP basic auth) from the hosted service to Zdravo's self-hosted Ollama model server, which computes embeddings for search	Text sent for embedding, such as memory content and search queries
Google (Gemini API)	Hosted text generation and image analysis; embeddings when the configured Ollama model server does not answer	Text and images sent to those features, such as memory content and search queries
OpenRouter	Further fallback for embeddings, and model routing for features that select it	Text sent for embedding or generation
Stripe	Billing and subscriptions	Billing contact and payment details (card data goes to Stripe, not Zdravo)
Sentry	Error monitoring	Error reports with request metadata
Upstash	Redis for rate limiting, webhook idempotency and cached public aggregates	Rate-limit counters keyed by user, key or IP; Stripe event ids; no memory content

What is not claimed

Certification: No SOC 2, ISO 27001 or HIPAA certification. A SOC 2 Type I has not started.
Penetration test: No independent third-party penetration test yet. Internal adversarial testing is not a substitute and is not presented as one.
Agent-wide enforcement: Connecting Zdravo to an AI client does not intercept that client's own tools. Only actions routed through a Zdravo-governed path are evaluated and recorded.
Zero-knowledge: The hosted service processes stored context to retrieve it. Organization memories are envelope-encrypted at rest; the service holds the keys.
Residency and SLA: No EU, UK or on-premise residency by default, and no contractual uptime SLA unless an agreement provides one.

Open items

Counsel-reviewed DPA and MSA, including breach-notification timelines and the contractual sub-processor list.
Independent penetration test and SOC 2 Type I.
KMS signature verification of the audit chain runs only where the production workload identity is available; the hash chain itself is verified from any environment.
Scheduled database jobs: definitions are not yet reproducible from the migration chain and job failures do not yet alert anyone (see the scheduled-jobs row).
An air-gapped container build is in the repository; a managed single-tenant or VPC option is not yet offered.

Security questionnaire (CAIQ / SIG-Lite draft), architecture review, threat model, or a vulnerability report:

security@zdravo.ai

security.txt Security architecture Compliance posture Status

Evidence you can re-run.

Verification results

Captured against the production project and the commit shown. A result is only as current as its capture time.

Tenant isolation

Row-level security is on for every public table; no always-true row filter, anonymous write grant or unfiltered authenticated mutation reaches an end-user role.

5/5 pass

Captured: 2026-10-27 19:25 UTC
Commit: 99ccdbca4
Target: zxibljbvgenwskjjkkdf

Checks and re-run command

passrls_enabled_on_every_public_table
passno_always_true_filter_for_end_user_roles
passno_write_privileges_for_anon
passno_unfiltered_authenticated_mutation
passapi_layer_no_anonymous_reads

node scripts/verify-tenant-isolation.mjs

Database privilege hygiene

5/5 pass

Captured: 2026-10-28 03:48 UTC
Commit: d98fa726d
Target: zxibljbvgenwskjjkkdf

Checks and re-run command

passanon_cannot_reach_public_schema
passanon_has_no_table_write_privileges
passauthenticated_has_no_truncate_references_trigger
passno_browser_executable_security_definer_functions
passlocal_migrations_all_recorded_in_production

node scripts/verify-p0-closure.mjs

Policy and privilege consistency

Every row policy for signed-in users has the table privilege it needs, and no route asks the database for a verb the session role does not hold.

4/4 pass

Captured: 2026-10-27 19:26 UTC
Commit: 99ccdbca4
Target: zxibljbvgenwskjjkkdf

Checks and re-run command

passlive_policy_privilege_rows_captured
passevery_end_user_policy_has_its_privilege
passauthenticated_can_reach_public_schema
passno_session_role_query_with_denied_verb

node scripts/check-rls-privilege-consistency.mjs --live

Browser-callable database functions

Every function a browser role may execute is listed with a written justification, and the list matches what production grants.

6/6 pass

Captured: 2026-10-27 19:38 UTC
Commit: 8607ced3e
Target: zxibljbvgenwskjjkkdf

Checks and re-run command

passlive_database_browser_grants_captured
passno_unlisted_browser_rpc
passbrowser_grants_match_allowlist_roles
passno_stale_allowlist_entries
passallowlist_entries_name_real_functions
passno_duplicate_allowlist_declarations

node scripts/check-rpc-allowlist.mjs --live

Transport and browser controls

Nonce-based CSP, exact-origin CORS, framing denial and no-store on authorization responses, measured on what zdravo.ai serves.

9/9 pass

Captured: 2026-10-28 02:14 UTC
Commit: 2068c0fae
Target: https://zdravo.ai

Checks and re-run command

passhtml_pages_carry_a_nonced_csp
passapi_responses_carry_a_nonced_csp
passroute_owned_csp_is_not_replaced
passunenumerated_subdomain_gets_no_credentialed_cors
passunrelated_origin_gets_no_credentialed_cors
passfirst_party_origin_still_gets_credentialed_cors
passauth_endpoint_responses_are_not_cacheable
passauth_code_callback_is_not_cacheable
passbaseline_headers_present

npm run verify:headers

Service objectives and audit chain

Latency and error metrics are recorded, the hash-chained audit log verifies for every organization, and erasure cascades complete.

8/9 pass

Captured: 2026-10-27 19:27 UTC
Commit: 99ccdbca4
Target: zxibljbvgenwskjjkkdf

Checks and re-run command

passslo_2_1_latency_sli_is_instrumented
passslo_2_2_error_rate_sli_is_instrumented
passslo_2_3_decision_throughput_within_budget
passslo_2_3_policy_latency_and_denial_rate_measured
passslo_2_4_audit_hash_chain_verifies
failslo_2_4_kms_signatures_verifiable
passslo_2_5_cascade_completion_rate
passslo_2_5_cascade_dead_letter_rate
passslo_2_5_expired_lease_rate

node scripts/verify-slos.mjs --live

Scheduled jobs

Database jobs are reproducible from migrations, hold no literal credentials, complete their runs, and their failures are observed.

3/7 pass

Captured: 2026-10-27 19:26 UTC
Commit: 99ccdbca4
Target: zxibljbvgenwskjjkkdf

Checks and re-run command

failjob_definitions_are_reproducible_from_the_active_migration_chain
passno_literal_credentials_in_job_definitions
passscheduled_http_calls_target_production
failscheduled_http_delivery_succeeds
faildelivery_evidence_window_covers_daily_schedules
passevery_active_job_has_a_completed_run
failfailed_job_runs_are_observed

node scripts/verify-scheduled-work.mjs --live

Verify a decision without trusting us

Every governed action gets a decision. Allow, deny or hold for a person, with the policy that decided it, recorded before the action runs.

Decisions are signed. A decision receipt is a compact JWS signed with ES256 by a Google Cloud KMS key; the private key never leaves KMS. Arguments appear only as a SHA-256 hash.

Keys are public. Verify a receipt you hold against the published keys, ideally pinned out of band: /api/receipts/keys.

Third-party services

Services the production deployment is configured to use, and the data each receives. The contractual sub-processor list will be part of the DPA, which is under counsel review.

Service	Purpose	Data it receives
Vercel	Application hosting and edge network (US)	All request traffic, including API calls and session cookies
Supabase	Postgres database, authentication and file storage (AWS us-west-2)	Account data, organization data, memories (organization memories envelope-encrypted), audit and decision records
Google Cloud	Cloud KMS signing key for decision receipts and audit events; Cloud Storage for audit-chain anchors; Google sign-in	Hashes and signatures (no memory content) for KMS and anchors; name and email for Google sign-in
ngrok	Tunnel (HTTP basic auth) from the hosted service to Zdravo's self-hosted Ollama model server, which computes embeddings for search	Text sent for embedding, such as memory content and search queries
Google (Gemini API)	Hosted text generation and image analysis; embeddings when the configured Ollama model server does not answer	Text and images sent to those features, such as memory content and search queries
OpenRouter	Further fallback for embeddings, and model routing for features that select it	Text sent for embedding or generation
Stripe	Billing and subscriptions	Billing contact and payment details (card data goes to Stripe, not Zdravo)
Sentry	Error monitoring	Error reports with request metadata
Upstash	Redis for rate limiting, webhook idempotency and cached public aggregates	Rate-limit counters keyed by user, key or IP; Stripe event ids; no memory content

What is not claimed

Certification: No SOC 2, ISO 27001 or HIPAA certification. A SOC 2 Type I has not started.

Penetration test: No independent third-party penetration test yet. Internal adversarial testing is not a substitute and is not presented as one.

Agent-wide enforcement: Connecting Zdravo to an AI client does not intercept that client's own tools. Only actions routed through a Zdravo-governed path are evaluated and recorded.

Zero-knowledge: The hosted service processes stored context to retrieve it. Organization memories are envelope-encrypted at rest; the service holds the keys.

Residency and SLA: No EU, UK or on-premise residency by default, and no contractual uptime SLA unless an agreement provides one.

Open items

Counsel-reviewed DPA and MSA, including breach-notification timelines and the contractual sub-processor list.

Independent penetration test and SOC 2 Type I.

KMS signature verification of the audit chain runs only where the production workload identity is available; the hash chain itself is verified from any environment.

Scheduled database jobs: definitions are not yet reproducible from the migration chain and job failures do not yet alert anyone (see the scheduled-jobs row).

An air-gapped container build is in the repository; a managed single-tenant or VPC option is not yet offered.