Security
How we keep our own house in order
A company that protects AI agents should show how it works itself. Here is how to report a vulnerability to us, how our software is built and delivered, and what our products record and where.
Reporting a vulnerability
Found a weakness? Tell us first.
Write to info@zeravatech.ca with “Security” in the subject. We confirm that we have your report within two business days and tell you what we will do about it.
- What to send. The product and its version, what you did, what happened, and how we can reproduce it.
- What to test. Your own installations of Vid, of Perun if you have it, and of our free tools.
- What not to do. No attacks on other people’s systems or data, on our website’s contact form, or on the services we use, and no denial of service.
- Before you publish. Give us a reasonable time to fix it. We will tell you when the fix is out and, if you wish, name you in its release notes.
The same contact, machine-readable: /.well-known/security.txt.
How we build and ship
Open source, with a checksum on every file
- Open source. Vid, Pivot Benchmark, PSE Analyzer and every tool on Downloads and Labs are free and open source under GPL-3.0, with their code at github.com/zeravatechnologies.
- A checksum on every file. Each build is published as a GitHub release, and its SHA-256 is shown beside the download, so you can check that the file you have is the file we built.
- Code signing is coming. Our current builds are not code-signed yet, so Windows shows a SmartScreen warning. Until they are, compare the checksum before you run a file. Our Code signing policy says how builds will be signed through SignPath Foundation.
- Perun is never a public download. We deliver it to you directly and install it with you.
- This website is static, sets no tracking cookies, and is served with a strict content security policy and HTTPS only.
What Perun records
Every decision, on your computers
- Nothing comes to us. Perun runs on your computers, with no cloud and no telemetry.
- A record that is only added to. Every decision is written to a signed, append-only record. Nothing in it is edited afterwards.
- A check on the checker. A separate process, the meter, controlled only by people, reads that record and checks Perun’s reports against it.
- People answer, by name. Every human answer, to approve, reject or trust, is given by a logged-in operator and recorded.
- Fails closed. If Perun itself is in doubt, it stops traffic rather than let it through unread.
Where your data goes
Product by product
- Vid and Perun. On your computers. The only traffic is the calls your agent already makes to its model.
- Free tools. On your computer. A tool calls an online model only when you choose one, with your own key; Pivot Benchmark, for example, calls Gemini as the adversary model.
- Leaf. A hosted service, so it processes data on our servers, as its own privacy notice describes.
- This website. A message you send through a form goes to our inbox through a function on Amazon Web Services in Canada. We use it only to reply, as the privacy policy says.
Contact
Questions from your security team?
Send them over. We answer vendor questionnaires and walk your team through how Perun is installed and what it records.
NDA available for commercial discussions · Toronto, Ontario, Canada