Security Policy

Security is a core design principle of Zegi.

Last updated: 2026-08-20

This is a foundation document. Final legal text must be reviewed by qualified UAE legal counsel before launch.

Data in transit

All traffic is served over HTTPS in production, with strict transport security.

Uploads are validated by content (magic bytes), sanitized, size-limited and rate-limited.

Secrets are stored in environment variables and never committed to source control. API secrets are stored only as hashes.

To report a security issue, contact security@zegi.ae.