Data & Privacy
Two Surfaces separates your Stack, where Zozo runs your work, from the Control Plane, which operates the hosted service. That boundary determines where each kind of data lives and what crosses between the two.
Stacks are hosted in the EU (Germany or Finland) for now. This EU-only hosting location applies to the repository files, git history, Thread history, and Credential values that remain on your Stack.
What Stays on Your Stack
Your Thread's append-only Event journal stays on your Stack. The journal is the durable record used to stream, resume, and render each Run. The Control Plane doesn't receive its messages or Events.
Repository files and git history also stay in the Workspaces where your Runs execute. Operational reporting may identify a Project, Thread, or Run, but it doesn't transmit the contents of a Workspace or its git history.
What the Control Plane Receives
The Control Plane holds the facts required to provide and operate your hosted Stack, including:
- Account, billing, and Stack lifecycle state.
- Aggregate token and cost usage reported by your Stack.
- Closed operational health and status fields used to detect problems and coordinate updates.
- Identifiers and timestamps needed for hosted operations and audit history.
These reports use defined fields. They don't include Thread messages, Event payloads, repository contents, or free-form Credential values.
How Credentials Are Kept Separate
Your Credential is stored in a secured store on your Stack and injected only into the Runtime that needs it. Its value isn't written to the Event journal, included in a Workspace, or sent to the Control Plane.
Status reporting may include a Credential's name and a closed health state such as valid, invalid, or not yet provisioned. A Credential name isn't a secret. Its value never appears in that report. See Auth & Consent for provisioning and consent details.
How Recovery Backups Work
Zozo creates a daily encrypted Stack Backup for disaster recovery. It contains the Event journal and the Dispatcher's push state. It excludes Credentials and Workspaces.
The Stack encrypts the backup before uploading it to object storage on a provider separate from the compute host. The Control Plane keeps the encryption key so it can provide that key to a rebuilt Stack. Recovery creates a new Stack and feeds the backup into it; Zozo doesn't restore over a Stack that's still running.
The Stack Backup is an operational recovery artifact. Use an Export Archive when you want your own downloadable copy.
How Zozo Replaces Host Infrastructure
Zozo periodically moves your Stack onto freshly built host infrastructure it manages — for example to roll out a security update to the underlying image. Your Stack's identity, data, and Credentials move with it; nothing about how you reach or use your Stack changes.
During that move, your Stack briefly stops accepting new work while its replacement is prepared from your existing data in the background. Zozo never routes any traffic, or lets the replacement register a Credential refresh or otherwise act on your behalf, until the replacement has proven itself healthy against the exact software and data it was built from for several continuous minutes. Only then does Zozo switch your Stack over, reopen it to new work, and retire the old infrastructure. If the replacement ever fails that check, Zozo reverses course automatically and your original infrastructure keeps running — you're never left without a working Stack.
Downloading an Export Archive
You can request an Export Archive from your authenticated Dashboard, the web interface on your Stack. The download travels directly from your Stack to your browser and doesn't route through the Control Plane.
The archive is unencrypted because it's delivered to you over your existing authenticated session. It contains a manifest, the raw Event journal, and a git bundle for every Thread that currently holds an Unshipped attempt, which is committed work that hasn't reached your remote. See Export Your Data for the steps.
Protecting Unshipped Work During Closure
Account closure won't silently discard an Unshipped attempt. When your Stack holds committed work that hasn't reached your remote, decommissioning waits for your explicit confirmation before destroying the infrastructure.
Download an Export Archive before confirming if you want to preserve that work. See Close Your Account for the complete closure flow.
Related
- Two Surfaces: understand the boundary between your Stack and the Control Plane.
- Auth & Consent: connect and manage a Credential.
- Export Your Data: download an Export Archive.
- Close Your Account: preserve work before closing your hosted account.