Security

Security at a glance

Tenant-scoped memory

Every memory and cache entry carries tenant_id and namespace. Requests can also use X-Zepto-Tenant-Id, with conflict rejection when JSON and header disagree.

No provider calls

ZeptoDB does not call embedding providers or LLM providers from the server. Applications control prompts, models, provider credentials, and embeddings.

Encryption

TLS 1.3 on every endpoint, including cluster RPC. Optional mTLS for service-to-service auth. Data encrypted at rest through deployment storage controls.

Authentication and RBAC

JWT / OIDC, API keys with rotation, mTLS client certificates, and RBAC with built-in admin, writer, reader, analyst, and monitor roles.

Agent Memory security model

Agent Memory stores operationally sensitive context: summaries, retrieved facts, prompt cache entries, and metadata. The v0 model keeps those boundaries explicit:

Memory and cache entries are scoped by tenant and namespace
Search/context requests can filter by user, session, agent, type, TTL, and metadata
Aggregate stats omit memory content, prompts, responses, and metadata
Prometheus metrics expose counts, dimensions, evictions, and capacity limits only
Embeddings are client-supplied; ZeptoDB validates dimensions and rejects NaN/Inf
Metadata is caller-provided JSON text, so applications can attach source and trust hints
Server-side LLM and embedding provider credentials are not part of the default path

In cluster mode, Agent Memory is currently node-local. Use sticky routing for /api/ai/* if you need one consistent memory view.

Compliance

ZeptoDB ships the evidence primitives teams need across agentic operations, finance, industrial, automotive, and utilities:

Standard	Relevance	Status
SOC2 Type II	Audit logging, RBAC, encryption, change evidence	Ready
MiFID II	Trade audit trail, access controls, decision replay	Ready
GDPR	Namespace isolation, deletion support, tenant scoping	Ready
PCI DSS	TLS 1.3, access controls, audit logging	Ready
IEC 62443	Industrial control systems authN/authZ and audit	Evidence-ready
ISO / SAE 21434	Automotive cybersecurity and replayable data handling	Evidence-ready
NERC CIP	Electric utility operational monitoring	Evidence-ready

Regulated deployments typically want SSO, audit export, namespace isolation, and deployment review — all available on the Enterprise tier.

Security features

Transport security

TLS 1.3 on HTTP, Arrow Flight, and cluster RPC
mTLS for cluster-internal communication
Configurable cipher suites and certificate rotation

Authentication

JWT / OIDC with automatic token validation and refresh
API key management with creation, rotation, and revocation
Multi-factor via OIDC provider delegation

Authorization

Role-based access control with 5 built-in roles
Per-namespace permissions for multi-tenant deployments
Query-level access control for table and column restrictions

Agent Memory isolation

Tenant and namespace required on memory/cache records
Optional user, session, agent, and type filters
TTL and capacity eviction controls
Pinned memory protection for capacity eviction

Audit logging

Auth events, failed attempts, queries, and admin actions
Structured JSON compatible with Splunk, ELK, Datadog, and SIEM workflows
AgentOps telemetry tables for agent runs, retrieval events, cache events, LLM calls, and tool calls

Responsible disclosure

Found a security issue? Please report it responsibly:

skswlsaks@gmail.com

We aim to acknowledge reports within 48 hours and provide a fix timeline within 5 business days.

For detailed configuration, see the Security Operations Guide and SSO Integration Guide.

Edition availability

Feature	Community	Enterprise
Single-node Agent Memory	✓	✓
Exact / semantic prompt cache	✓	✓
Agent Memory sidecar snapshots	✓	✓
TLS 1.3 / mTLS	✓	✓
API key authentication	✓	✓
Basic RBAC	✓	✓
Rate limiting	✓	✓
Audit logging	✓	✓
SSO / OIDC	—	✓
Audit log export	—	✓
Advanced RBAC	—	✓
Multi-node time-series clustering	—	✓

Enterprise-gated endpoints return HTTP 402 with an upgrade URL:

{
  "error": "enterprise_required",
  "message": "SSO requires Enterprise license",
  "upgrade_url": "https://zeptodb.com/pricing"
}

See Pricing for edition details and trial information, or Talk to Sales → for a regulated-deployment review.