Security
Documentation work reads everything. So this page comes first.
To describe how an organization works, a tool has to read the material that describes it — the repositories, the process documents, the threads where decisions were actually made. There is no version of this product that touches only harmless data. That is why the handling model was settled before the features were.
Where the processing happens
The two products answer this differently, because the material is different.
Engineering
Deploys as a CloudFormation stack into an AWS account the customer owns and controls. Source code is read in place. It is not cloned to, staged in, or processed by infrastructure belonging to Zipper Data Co..
Operations
Source material is more scattered — wikis, mailboxes, drives — so processing runs inside a single defined boundary per customer, with the region, the retention period and the deletion trigger set by the customer rather than defaulted by us.
What the product asks for
- Read-only, and scoped. Access is requested per source and per scope. A tool that documents your process has no reason to hold write access to it.
- Enumerated, not inferred. Which repositories, which spaces, which drives — named by the customer. The product does not discover and crawl whatever a credential happens to reach.
- Revocable in one move. Access runs through a role or grant the customer created, so the customer can end it without asking us to act.
What we will not do
- Train models on customer content, or let a subprocessor do so. This is a contractual commitment, not a setting.
- Use one customer's material to produce output for another.
- Sell, rent or share customer content, or use it for advertising.
- Retain customer content after an engagement ends beyond the window the agreement names.
Subprocessors
Amazon Web Services provides the compute, storage and model inference the products are built on. For the Engineering product running in a customer account, that AWS account is the customer's own. Any change to this list that affects customer content is disclosed to customers before it takes effect.
This website runs on AWS in the United States and collects only what the privacy page describes. It carries no analytics scripts, advertising pixels or third-party trackers.
Security review
Send us your questionnaire. We complete them ourselves rather than routing them through a sales engineer, and we will tell you directly what we can evidence and what we cannot — a straight answer is worth more to both sides than a confident one.
If your organization needs a data processing agreement, defined retention terms or a specific deployment topology before a pilot, raise it in the first conversation. Those are architecture questions here, not procurement exceptions, and the answers are usually already in the design above.
Evaluating anyone in this category
We publish the checklist we think any buyer should run against an automated documentation vendor, ourselves included. It is deliberately hard on us.
AI documentation tools: what to check before you connect one →Reporting a vulnerability
If you find a security issue in this website or in anything we ship, report it through the contact form and mark it as a security report. We will acknowledge it, and we will not pursue anyone who reports in good faith and does not access or alter data that is not theirs.