Sovereign tenancy
- Every organisation operates inside its own secure tenant.
- Data, billing, configuration, and audit remain isolated.
- No cross-tenant accounting visibility or hidden aggregation.
Trust & Boundaries
Clear structure. Explicit authority.
zenOps enforces tenant isolation, mandatory MFA, scoped access, and auditable actions by design.
Mandatory MFA
- TOTP, WebAuthn security keys, and passkeys are supported.
- Single-factor access is not permitted.
- Authentication verifies identity; authorisation remains tenant-scoped.
Role-based access
- Permissions are explicit and scoped by responsibility.
- Authority to view, modify, or administer is deliberate.
- No implicit privilege.
Support without overreach
- Support access must be explicitly granted.
- Impersonation is declared, time-bound, and auditable.
- No permanent administrative backdoors.
Auditable by design
Access changes, subscription adjustments, privilege elevation, and system interventions are recorded in an immutable audit stream.
zenOps runs on xOps to enforce identity guarantees, subscription authority, and boundary services beneath a calm operator experience.