Security at Zim Estates

How we protect your data, and how to report a vulnerability.

How we protect you

• All traffic is encrypted in transit (HTTPS / HSTS).
• Identity documents (KYC) are stored in a private, access-controlled bucket and never shown to other users.
• Sessions use signed, short-lived tokens; identity is verified server-side on every request.
• Payments are confirmed by a cryptographically verified provider webhook — never by the browser alone.
• Uploads are validated by content, rate-limited, and screened; bot traffic is challenged.
• Database backups with point-in-time recovery are enabled.

Reporting a vulnerability

We welcome reports from security researchers. If you believe you have found a vulnerability, email zimestates@outlook.com with steps to reproduce. Our machine-readable contact is published at /.well-known/security.txt.

Please do: give us reasonable time to fix the issue before public disclosure, and only test against your own account.

Please don't: run automated scans that degrade service, access other users' data, or perform destructive testing.

Acting in good faith under this policy, we will not pursue legal action and will credit you (with your permission) once the issue is resolved.