At zonaebt, we recognize that the confidentiality, integrity, availability, and sustainability of the information and data we manage are vital to the success of our business and the privacy of our partners.

As a green-focused service provider, we understand the importance of transparency regarding our security practices, operational compliance, and environmental responsibilities. This Trust Center highlights our commitment to mitigating risks, protecting user data, and championing renewable energy initiatives so our customers can feel confident in choosing us as their trusted partner.

Founded in 2021

|
|

Controls (12)

Here are the controls implemented at zonaebt to ensure compliance, as a part of our security program.

Product security (2)

Role-Based Access Control (RBAC)

Restricting backend access to authorized personnel only, ensuring that team members only have access to modules necessary for their job functions.

Internal Training on Data Integrity

Standard training for team members handling carbon project data and renewable energy certificates to maintain integrity and prevent fraudulent claims.

Data security (3)

Secure Payment Tokenization

Integrating with PCI-DSS compliant payment gateways (Xendit) to process transactions securely without storing sensitive financial card details on our local servers.

Encryption in Transit

Enforcing HTTPS (SSL/TLS) across all web platforms, including ZonaEBT and its Academy subdomains, to protect user interactions and form submissions from interception.

Database Backups

Automated, periodic backups of transaction histories, user records, and operational data to prevent data loss.

Network security (2)

Web Application Firewall (WAF)

Implementing firewall protections at the server level to mitigate DDoS attacks, malicious traffic, and common web vulnerabilities.

Secure API Endpoints

Restricting and monitoring API access for internal systems (such as the voucher validation and certificate check scripts) using authentication keys and rate limiting.

App security (2)

Secure Code Auditing

Regular updates and vulnerability patching for the underlying CMS (WordPress) and custom PHP/JavaScript web architectures.

Input Validation & Sanitization

Enforcing strict input validation mechanisms across all digital forms, including the carbon offset voucher verification system, to block SQL injection and Cross-Site Scripting (XSS).

Endpoint security (1)

Multi-Factor Authentication (MFA)

Mandatory MFA for administrators and technical leads accessing server configurations, hosting environments, and core databases.

Corporate security (2)

Access Revocation Protocols

Immediate termination of credentials and access rights for offboarded personnel or external contributors.

Incident Response Plan

A structured internal protocol to quickly identify, isolate, and mitigate potential data anomalies or server downtimes.

Create your own Trust Center | Powered by

Sprinto Logo