数据安全说明
面向企业采购与安全团队，概述 ZovaX IDE 的安全控制（不构成单独合同，以签署的 DPA/服务协议为准）。
1. 责任边界
- 我方：服务端访问控制、补丁、监控、备份与加密传输默认值。
- 客户：终端加固、凭据保管、不得向遥测写入密钥或完整源码。
2. 数据流
客户端本地存储工作区；账号/设备数据经 TLS 进入业务库；云端 AI 仅传输必要上下文至受控模型 API。
3. 加密与访问
- 对外 API 使用 HTTPS/TLS 1.2+
- 密码由身份服务哈希存储，不以明文进入遥测或业务日志
- 管理后台与运维接口使用独立凭据与最小权限
4. 主动防御（训练数据投毒）
- 微调语料、知识库导入、进化训练样本入库前经 主动投毒防御管线 筛查（分布漂移 MMD/KL、主动探针、因果校验、贝叶斯风险分）。
- 高风险样本进入隔离池
data/poison_quarantine.jsonl，不进入训练闭环；可通过 Gateway/api/nova/poison-defense或 IDE 命令nova.poison.*复检。 - 此为启发式前置防线，高价值场景仍建议人工审核与依赖扫描（Security Scan）叠加。
5. 事件响应
发生可能影响个人数据的安全事件时，我们将按适用法律通知用户与监管机构（如适用）。
Data security overview
For enterprise procurement and security teams: a high-level summary of ZovaX IDE controls (not a standalone contract; the signed DPA/MSA controls).
1. Responsibility split
- Us: server access control, patching, monitoring, backups, and default encrypted transport.
- You: endpoint hardening, credential hygiene, and never putting secrets or full source into telemetry.
2. Data flows
Workspaces stay on the client by default; account/device data reaches our business store over TLS; cloud AI sends only necessary context to controlled model APIs.
3. Encryption and access
- Public APIs use HTTPS/TLS 1.2+
- Passwords are hashed by the identity service; never stored in plaintext telemetry or business logs
- Admin and ops interfaces use separate credentials and least privilege
4. Active defense (training data poisoning)
- Before fine-tune corpora, knowledge imports, or evolution samples enter training, they pass an active poisoning defense pipeline (distribution drift MMD/KL, active probes, causal checks, Bayesian risk score).
- High-risk items go to quarantine (
data/poison_quarantine.jsonl) instead of the training loop; re-check via Gateway/api/nova/poison-defenseor IDEnova.poison.*commands. - This is a heuristic front gate; pair with human review and dependency Security Scan for high-value workloads.
5. Incident response
If a security incident may affect personal data, we will notify users and regulators as applicable law requires.
Privacy questions: privacy@zovax.ai (Data protection contact: {dpo})