Security & Compliance

Zigza is designed with a simple security principle: Defense-in-Depth. We understand that in garment manufacturing, your pre-season styles, buyer pricing, cutting efficiencies, and operator piece rates are confidential trade secrets that must be guarded against accidental leaks and malicious access.

We protect all factory information with high-grade cryptography across both movement and long-term storage:

Cryptographic keys are managed and rotated using Hardware Security Modules (HSMs), preventing unauthorized access even in the unlikely event of physical server loss.

Many factories run orders for competing buyer brands (e.g. Ollypop, Zara, Urban Outfitters, or private labels) at the same time. Zigza guarantees complete database separation:

• PostgreSQL Row-Level Security (RLS): Every table in our database—including orders, style sketches, cutting bundles, and wage books—is tagged with your factory’s verified account ID. Database queries can only return rows that match your active session.
• Cryptographic Isolation: Even if a developer or user makes an unexpected query, the database itself denies access to rows belonging to any other factory or brand.
• Order Segregation: Cut pieces, bundles, and fabric rolls meant for Buyer A cannot be assigned to Buyer B without manager overrides that are permanently logged.

Apparel sheds often experience dead Wi-Fi zones. Our companion mobile app provides offline functionality with strong local protection:

• Encrypted Local Storage: When workers scan bundles in offline zones, the records are buffered in encrypted local storage on the phone.
• Tamper-Proof Timestamps: Scans include cryptographically signed device timestamps to prevent date or time manipulation.
• Duplicate Prevention: Upon network reconnection, the server reconciles all buffered scans using strict First-Scan-Wins logic, preventing duplicate bundle payouts.

In compliance with Section 16 of the Digital Personal Data Protection Act (DPDPA), 2023, your factory data never leaves the territory of India:

Not everyone on the factory floor needs to see every piece of information. Zigza enforces strict Role-Based Access Control (RBAC):

• Floor Operators: Can only scan assigned bundle tickets and view their immediate task instructions.
• Cutting Masters: Can manage lay lengths and cut ratios, but cannot view buyer margins or company-wide profit summaries.
• Store In-Charge: Can view fabric roll weights and allocations, but cannot alter tech pack measurements.
• Factory Admins: Hold sole management authority over user permissions, subscription billing, and 1-click Excel exports.

Zigza includes an AI floor assistant to help production managers quickly analyze bottlenecks and fabric consumption.

When you ask a question, the assistant only searches your private factory database in temporary memory. As soon as your chat session ends, all prompt context is immediately deleted.

To protect your factory from accidental data loss or hardware outages, Zigza runs automated backup routines:

• Daily Snapshots: Encrypted database backups are taken automatically every day and stored redundantly.
• Point-in-Time Recovery: Transaction logs are continuously preserved so records can be restored to the exact minute in the event of an emergency.
• Fast Restoration (RTO < 2 Hours): In the rare event of a primary cloud center outage, operations can be restored within 2 hours.

Security is not a one-time setup; it is an ongoing practice:

• Continuous Code Scans: Every software update undergoes automated static code analysis to catch vulnerabilities before going live.
• Third-Party Penetration Tests: We conduct periodic vulnerability assessments and penetration tests to verify our defenses against common web threats (OWASP Top 10).
• 24/7 Anomaly Alerts: Automated monitors track unusual traffic spikes or failed login attempts and alert our security team instantly.

Our cloud servers are hosted in ISO 27001-certified and SOC 2 Type II-audited facilities:

• Physical Controls: Biometric scanners, 24/7 armed security patrols, and video surveillance protect server halls.
• DDoS Mitigation: Enterprise edge firewalls shield all endpoints from distributed denial-of-service (DDoS) attempts.
• Private Virtual Cloud (VPC): Database clusters are hosted on private subnets with no direct public internet exposure.

We treat our internal access controls with the highest scrutiny:

• Principle of Least Privilege: Zigza personnel do not have access to your factory’s operational data unless you explicitly request technical troubleshooting.
• Mandatory 2FA: All internal administrative tools require hardware or authenticator-based two-factor authentication.
• Immutable Audit Trails: Sensitive system events, permission updates, and data exports are logged in an immutable audit trail for complete accountability.

We encourage security researchers and factory IT teams to contact us directly with any security questions or vulnerability reports: