Security

Last updated: 19 October 2026

We describe only protections that exist in the product and in how we run it.

Separate workspaces

Every customer gets its own database, and files and caches are kept apart too. One customer's data is not stored in another customer's database.

Sign-in protection

• Passwords are stored only as salted one-way hashes.
• Optional two-factor authentication for admin accounts, and an optional two-factor requirement for the platform owner panel.
• Sign-in attempts are rate limited.
• Every use of "sign in as a user" by an admin is written to an audit log.

Data in transit and at rest

The website, panels and tracking links are served over HTTPS. Payment card, UPI and bank credentials are handled by our payment partner on its own secure page, not by Zappila.

Tracking integrity

Conversions are written once through a locked ledger so a postback that fires twice cannot be counted or refunded twice. Postbacks can be protected with a secret token or an IP allow-list, and duplicate order IDs are rejected.

Backups and operations

We take regular backups and monitor the health of tracking, the job queue and scheduled tasks, and we are alerted when something stops running.

Report a vulnerability

If you find a security problem, please email [email protected] with the subject "Security". Give us a reasonable time to fix it before you share it, and do not access other people's data. We thank people who report responsibly.