Section 4: How We Store and Protect Your Information
Last updated 27 August 2026
4.1 Encryption
All traffic between your device and our servers is encrypted in transit using industry-standard TLS. Sensitive data at rest, including identity documents and liveness captures, is stored encrypted.
4.2 Credentials Are Hashed, Not Stored
Your password and your 5-digit App PIN are never stored in a form anyone can read, including us. They are put through a one-way cryptographic hash. If our database were ever exposed, your raw password and PIN would not be in it. This is also why we cannot tell you your PIN if you forget it — we can only help you reset it.
4.3 Access Control
Access to production data is restricted to the small number of staff who need it for a specific task, protected by multi-factor authentication, and recorded in an audit log. Support agents see only the account context their department needs to help you. Identity documents are kept in a private, non-public vault and are visible only to authorised administrators and compliance staff.
4.4 Custody Security
The majority of custodied assets are held in cold storage, offline and away from any internet-connected system, with hardware-backed key management. Only the working balance required for day-to-day withdrawals is kept in hot wallets.
4.5 Monitoring
We run continuous monitoring for unusual logins, brute-force attempts, abnormal withdrawal patterns and abuse of the reward system. Detected anomalies trigger automatic protective measures such as cool-down periods, session termination and the Security Account hold.
4.6 Where Your Data Is Held
Zelencio serves customers worldwide. Your data is processed on our own infrastructure and on the servers of the international providers listed in Section 3, which may be located in countries other than your own. Where data crosses borders, we rely on the safeguards required by the data protection laws that apply to you — including the EU and UK GDPR, Brazil’s LGPD, the Nigeria Data Protection Act and similar laws — including contractual protections such as Standard Contractual Clauses with each provider.
4.7 If Something Goes Wrong
No system is perfectly secure and we will not claim otherwise. If a breach occurs that is likely to put your rights at risk, we will notify the relevant supervisory authority and affected users without undue delay, explain what happened, what data was involved, and what you should do.
4.8 Your Part in This
The strongest security we can build is still defeated by a shared code. Use a unique password, enable two-factor authentication, and never give your PIN, two-factor code or one-time password to anyone — including anyone claiming to be Zelencio staff.