Zozo Docs

Data & Privacy ​

Two Surfaces separates your Stack, where Zozo runs your work, from the Control Plane, which operates the hosted service. That boundary determines where each kind of data lives and what crosses between the two.

Stacks are hosted in the EU (Germany or Finland) for now. This EU-only hosting location applies to the repository files, git history, Thread history, and Credential values that remain on your Stack.

What Stays on Your Stack ​

Your Thread's append-only Event journal lives on your Stack. The journal is the durable record used to stream, resume, and render each Run. The Control Plane doesn't receive its messages or Events through operational reporting. The encrypted Stack Backup is the one copy that leaves the Stack.

Repository files and git history also stay in the Workspaces where your Runs execute. Operational reporting may identify a Project, Thread, or Run, but it doesn't transmit the contents of a Workspace or its git history.

What the Control Plane Receives ​

The Control Plane holds the facts required to provide and operate your hosted Stack, including:

  • Account, billing, and Stack lifecycle state.
  • Aggregate token and cost usage reported by your Stack.
  • Closed operational health and status fields used to detect problems and coordinate updates.
  • Identifiers and timestamps needed for hosted operations and audit history.

These reports use defined fields. They don't include Thread messages, Event payloads, repository contents, or free-form Credential values.

How Credentials and Environments Are Kept Separate ​

Your Credential is stored in a secured store on your Stack and injected only into the Runtime that needs it. Its value isn't written to the Event journal, included in a Workspace, or sent to the Control Plane.

An Environment is a secured, named set of Variables that a Project pins to its Runs. Plain Variables remain readable in the Dashboard. Secret Variables are write-only after you save them. A Run receives the values as process environment variables, while its prompt lists only their names and kinds. Follow Give a Project Variables to create and pin one.

An Environment can also hold one Tailnet Key. Its value is write-only and stays out of the Runtime's process environment. Like Credentials and secret Variables, the Tailnet Key is excluded from Stack Backups, the Stack Audit Export, and Export Archives. It crosses a Host Replacement only inside the sealed Credential manifest, and crosses an Onramp only when you choose its Environment. With the container Executor, each Cell joins the tailnet before its Runtime starts and clears the key's handoff file.

Zozo replaces exact Credential and secret Variable values in Event text before appending it to the journal. This redaction is best-effort, not a security guarantee: values shorter than eight characters aren't redacted, and an encoded, split, or otherwise transformed value may not match the stored secret.

Status reporting may include a Credential's name and a closed health state such as valid, invalid, or not yet provisioned. A Credential name isn't a secret. Its value never appears in that report. See Auth & Consent for provisioning and consent details.

How Recovery Backups Work ​

Zozo creates a daily encrypted Stack Backup for disaster recovery. It contains the Event journal and the Dispatcher's push state. It excludes Credentials, Environments, and Workspaces. Variables can contain secrets, so they follow the same separate secret-handoff path as Credentials during a Host Replacement and never enter either a Stack Backup or an Export Archive.

After a restore from a Stack Backup, your operator re-enters Environments just as they re-enter Credentials. This keeps credentials and third-party secrets out of the backup bucket and prevents a rebuilt Stack from acting with restored secret material before a person supplies it again.

The Stack encrypts the backup before uploading it to object storage on a provider separate from the compute host. The Control Plane keeps the encryption key so it can provide that key to a rebuilt Stack. Recovery creates a new Stack and feeds the backup into it; Zozo doesn't restore over a Stack that's still running.

The Stack Backup is an operational recovery artifact. Use an Export Archive when you want your own downloadable copy.

How Zozo Replaces Host Infrastructure ​

Zozo periodically moves your Stack onto freshly built host infrastructure it manages, for example to roll out a security update to the underlying image. Your Stack's identity, data, Credentials, and Environments move with it; nothing about how you reach or use your Stack changes.

During that move, your Stack briefly stops accepting new work while its replacement is prepared from your existing data in the background. Zozo never routes any traffic, or lets the replacement register a Credential refresh or otherwise act on your behalf, until the replacement has proven itself healthy against the exact software and data it was built from for several continuous minutes. Only then does Zozo switch your Stack over, reopen it to new work, and retire the old infrastructure. If the replacement ever fails that check, Zozo reverses course automatically and your original infrastructure keeps running. You're never left without a working Stack.

Downloading an Export Archive ​

You can request an Export Archive from your authenticated Dashboard, the web interface on your Stack. The download travels directly from your Stack to your browser and doesn't route through the Control Plane.

The archive is unencrypted because it's delivered to you over your existing authenticated session. It contains a manifest, the raw Event journal, and a git bundle for every Thread that currently holds an Unshipped attempt, which is committed work that hasn't reached your remote. See Export Your Data for the steps.

Protecting Unshipped Work During Closure ​

Account closure won't silently discard an Unshipped attempt. When your Stack holds committed work that hasn't reached your remote, decommissioning waits for your explicit confirmation before destroying the infrastructure.

Download an Export Archive before confirming if you want to preserve that work. See Close Your Account for the complete closure flow.

Docs for Zozo: a coding-agent harness.

Copyright © Zozo