Security and hosting
How Zottle protects your data, where it is hosted and what you can expect from the platform.
Encrypted connections
The platform is served over HTTPS (TLS). The certificate is issued by Let's Encrypt and renewed automatically: traffic between your browser and the platform is encrypted.
Where the platform is hosted
Zottle runs on a server located in France, in the European Union. The application, the database and file storage are hosted there.
Accounts and passwords
Passwords are stored as bcrypt hashes, never in clear text.
Permissions are enforced on the server
Every request is authorised on the server against your workspace role and, inside a project, your project role. The interface hides what you cannot use, but the protection is the API: a request your role does not allow is refused, even if it is crafted by hand.
Workspace isolation
Data is organised by workspace. Access is granted workspace by workspace and project by project: you only reach the workspaces and projects you were admitted to, and a workspace's data, documents and settings stay scoped to its members.
Audit trail
The platform keeps an audit trail of sensitive operations, and a journal of authentication events — sign-ins and failed attempts — that you can review from your account security settings.
Your data stays yours
Your data belongs to you. Submissions export as CSV, region by region, and forms export as XLSForm — your results are not locked inside Zottle.
Backups
Backups of the database are kept on the hosting infrastructure. They protect the platform against an infrastructure failure; they are not a substitute for exporting the data you need to keep.
Subcontractors and personal data
How personal data is processed, including the service providers involved, is described in the Privacy Policy.