1. What the current scanner does
ZocoPilot's currently reviewed scanner retrieves selected publicly accessible website resources and applies technical checks.
These resources may include a public homepage, robots.txt, llms.txt and structured data.
These checks do not establish that a website is secure, legally compliant, indexed, or recommended by an AI assistant.
Planned features are not security capabilities until they have been implemented and verified.
2. Account data and public website content are different
Information published on a website may be publicly accessible.
Account details, billing identifiers and a person's use of ZocoPilot are separate information. A public domain name does not automatically make related account activity public.
Where account features are enabled, their access rules must be assessed separately from the scanner's ability to retrieve public pages.
Submitting a public website does not authorize ZocoPilot to change it or access restricted resources.
3. Authentication and access controls
ZocoPilot uses Supabase for its implemented authentication and database features.
Database row-level policies are part of the access-control design for account-associated information.
Authentication and database policies are not the entire security boundary. Backend routes, privileged operations, report-sharing features and caches also require appropriate authorization.
The use of a managed provider does not, by itself, establish that every application route is correctly configured.
This page does not claim dedicated infrastructure for each customer, separate databases for every account, or verified agency-workspace isolation.
4. Public reports and sharing
A public URL or report can be accessible to people beyond the original requester. An unlisted URL should not be treated as equivalent to authenticated access.
Any public-report or sharing feature must clearly explain:
- What becomes accessible
- Who can access it
- Whether authentication is required
- How sharing can be stopped
- Relevant caching or removal limitations
Submitting a scan must not be described as blanket permission to expose account activity or private history.
5. Infrastructure and service providers
We rely on third-party service providers for hosting and database infrastructure:
- Vercel: Website and serverless edge application hosting.
- Supabase: Managed database hosting and authentication services.
- Dodo Payments: Hosted checkout and subscription administration where payments are enabled.
Provider safeguards and ZocoPilot's application controls are related but different. A provider's certification does not automatically certify the ZocoPilot application.
We do not promise a particular storage region, dedicated tenancy, backup schedule, or recovery time unless it has been verified and expressly communicated.
For personal-information processing and relevant service-provider details, read our Privacy Policy.
6. External AI features
External AI functionality must be described according to the provider and processing method actually used.
A technical website check is not the same as a live query to ChatGPT, Claude, Perplexity or another assistant.
Before introducing a feature that sends information to an external AI provider, its data flow, applicable provider terms, access controls and privacy disclosures must be reviewed.
Do not submit confidential or sensitive information to a feature unless its stated purpose and supported controls permit that use.
7. Retention and deletion
Security controls and data-retention decisions are separate.
Removing information from the interface does not necessarily remove it from operational systems, backups or a payment provider.
Our Privacy Policy explains the applicable retention practices and how to make a privacy or deletion request.
For requests about personal information, email: hello@zocopilot.com
Do not promise immediate or complete deletion unless the process, exceptions and backup handling have been verified.
8. Reporting a security concern
If you believe you have found a security issue affecting ZocoPilot, please contact:
Please include in your report:
- The affected page or feature
- A short description of the issue
- When you observed it
- Safe reproduction steps, where available
- Redacted screenshots or other relevant evidence
We do not offer an encrypted reporting channel unless one is expressly published.
9. Safe reporting boundaries
Please avoid accessing another person's information, altering data, disrupting the service, testing stolen credentials, or conducting high-volume automated scans.
A public security contact is not blanket authorization for penetration testing or access to restricted systems.
If you encounter information that appears private, stop the activity and report the minimum detail needed to explain the concern.
This page does not establish a bug-bounty program, guarantee a reward, or provide a blanket legal safe harbour.
For testing that could affect the service, request written authorization before proceeding.