Control access to your workspace

Credentials for connected services are encrypted before they are stored. Sign-in email codes are hashed, and sign-in provider tokens are encrypted.

Error reporting disables automatic collection of request bodies, headers and cookies. Reports redact database values and use an internal user ID when identifying a person.

Public share links serve authorized snapshots. They do not give anonymous visitors a member’s synced data or a collaborative editing connection.

Share content with a person, a team or the workspace. Content can inherit access from its containing folder. Workspace administration roles and access to content are separate; owners have a dedicated emergency access path.

Sign in with a passkey, an email code, Google or GitHub.

Single sign-on with your identity provider uses OpenID Connect (OIDC) and is available on Enterprise. Workspace administrators manage its configuration and enforcement.

Zanbase Agent acts on behalf of the person using it, with that person’s permissions. Outside AI tools connect through the Model Context Protocol (MCP), with the person’s consent and permissions.

AI requests send prompts and relevant workspace content to model providers. Voice features send audio or reply text to speech providers. The Privacy Policy lists those services and the data they receive.

Workspace changes produce activity events with attribution. Access checks govern which events a person can read, including events about protected content.

Zanbase uses PostgreSQL for workspace data, Railway for application services and Cloudflare R2 for stored files. Calls and screen sharing run on LiveKit.

The provider inventory describes hosting, AI, email, payments and other services, including their purposes and processing locations.

Email corporate@zanbase.com with the affected feature, steps to reproduce the issue and its potential impact. Do not access or change another person’s data while testing. Coordinate disclosure with us so we can investigate.