Security at Zento

Last updated October 2026

Acupuncturists use Zento to keep appointments, intake answers and payments for real patients. This page describes, plainly, how that information is protected. It lists only measures that are in place today.

Where your data lives

All data is stored on Google Cloud in the United States (Iowa region).
The database is backed up every day. Seven daily backups are kept, and the database can be restored to any point in the last seven days.
The database has no public internet address. Only named members of our team can reach production systems, and only through Google’s own sign-in.

Encryption

Every connection to Zento uses HTTPS. Browsers are told never to connect without it (HTTP Strict Transport Security).
Connections between our servers and the database are encrypted too.
Everything stored is encrypted at rest by Google Cloud.
Patients’ intake answers get a second layer: they are encrypted with AES-256 before they are saved, under a key used for nothing else.

Protecting your account

Two-step verification with an authenticator app is available on every account, and required for every administrator. Turning it on needs your password and a code sent to your email, so someone at an unattended screen cannot set it up on your account.
After five wrong passwords or codes within 15 minutes, logging in pauses for 15 minutes, and the account holder is emailed (at most once a day). A browser you have logged in from before keeps its own count, so a stranger guessing at your address cannot lock you out of it.
New passwords must be at least 12 characters, and we check them against passwords that have appeared in public data breaches. The check never sends your password anywhere: only the first five characters of a one-way scrambled version of it leave our servers. If that check is briefly unavailable, the length rule still applies.
You are logged out automatically after a period without activity, 30 minutes unless you choose otherwise, so an unattended screen does not stay open.
You can see every device logged in to your account and log any of them out. That device loses access within a minute.
When your password is changed or reset, or two-step verification is turned on or off, we email you to confirm it.

Who can see what

Each acupuncturist sees only their own patients.
A small number of our own administrators can open any account to give support. They must use two-step verification, and anything they do while in an account is recorded under their own name, along with the account they were in.
Every time a practice opens or changes a patient’s record, intake answers or appointments, it is recorded: who, what and when. The record holds the identifiers of what was opened, never the health information itself.
Logins, failed logins and security changes are recorded the same way, and you can review your own under Security in your account. When an administrator reads these records, that is recorded too.

Payments

Card payments are processed by Stripe, which is certified to PCI DSS Level 1, the highest level for card processors.
Card numbers go straight from the patient’s browser to Stripe. Zento never sees or stores them.

Reporting a security problem

If you believe you have found a vulnerability, please write to hi@getzento.com. Tell us what you found and how to reproduce it, and give us a reasonable time to fix it before you share it with anyone else. We will not take action against anyone who reports a problem in good faith this way.