Security

Last updated: May 30, 2026

Security at a glance

ZenTLD is Apple-notarized, scanned by Apple for malware, and runs entirely offline on your Mac. Built by SOC 2-compliant Varyence. Below is the full security policy with verification steps and program details.

Notarized by Apple. Every release is scanned for malware by Apple's Notary Service and signed by a Varyence Developer ID. macOS Gatekeeper checks the ticket before each launch.
Hardened runtime, minimal entitlements. The app is built to reject code injection, dylib hijacking, and process memory tampering. No privacy-sensitive entitlements requested.
Verify with SHA-256. The current release hash is published in three locations across two independent providers. Check your download matches before you install.
Zero data collection by the app. No servers contacted, no analytics, no telemetry. Everything happens locally on your Mac.
SOC 2 compliant parent. Built by Varyence under an externally audited Information Security Program. Found a vulnerability? Email security@zentld.com; we acknowledge within two business days.

This summary is for clarity, not a replacement for the formal security policy. If anything below conflicts with the summary above, the formal policy controls.

Protecting the people who use ZenTLD™ and the data they trust on their Macs is one of our most important responsibilities. We are committed to being transparent about our security practices and helping you understand our approach.

ZenTLD is built by Varyence, Inc., a software development and cybersecurity company. Varyence is SOC 2 compliant and gets audited by an external auditor. The same security program that governs Varyence engagements with enterprise clients governs how we develop, sign, and distribute ZenTLD.

The ZenTLD application

Notarized by Apple

Every public release of the ZenTLD macOS application is signed with a Varyence-controlled Apple Developer ID certificate and submitted to Apple's Notary Service. As part of notarization, Apple scans the binary for known malware and other security threats before issuing a notarization ticket. The ticket is then stapled to the installer so the verification works offline.

When you open the downloaded installer on your Mac, macOS Gatekeeper checks the notarization ticket. If the binary has been tampered with after notarization, or if the certificate has been revoked by Apple, Gatekeeper refuses to open it. This is the same protection model that ships every Mac app distributed outside the App Store.

Verify your download

You can confirm that the installer you downloaded has not been modified by comparing its SHA-256 hash against the value we publish here.

The current release SHA-256 is:

2d3220eaf32c94cba32afdb7fa5169d5d92c0c2382cdebb0c79ba8e005b71158

To check it on your Mac after downloading, open Terminal and run:

shasum -a 256 ~/Downloads/ZenTLD-1-1.dmg

The output should match the SHA-256 above. If it does not, do not open the file. Delete it and contact us at security@zentld.com.

You can also download a machine-readable hash file and let shasum compare automatically. Both files must sit in the same folder for this to work:

cd ~/Downloads
curl -O https://utilitiesusa.blob.core.windows.net/zentld/ZenTLD-1-1.dmg.sha256
shasum -a 256 -c ZenTLD-1-1.dmg.sha256

If shasum -c prints ZenTLD-1-1.dmg: OK, the file matches. The hash is published in three locations across two independent infrastructure providers: here on zentld.com, in the .sha256 sidecar file on Azure Blob Storage, and in our release notes on the same Azure container. To detect a sophisticated attack you can cross-check any two against each other.

No data collection

The ZenTLD application transmits no telemetry, contacts no Varyence servers, includes no analytics SDK, and stores nothing outside your Mac. Your search history and settings live in local app storage and never leave the device. The only network traffic the app makes is the registry lookups described in the next subsection.

Where your query goes

When you search for a domain, ZenTLD sends the query directly to the authoritative source for that top-level domain (for example, the operator of .com or .ai). Your query and IP address are visible to that source, which logs them as a routine part of how the system works. Every domain lookup, no matter how it is made, eventually reaches the same authoritative source. ZenTLD does not change that.

What ZenTLD removes is everything between you and that source. Most domain-check websites act as middlemen: they receive your query, store it, often combine it with their analytics and advertising trackers, and only then forward it on. With ZenTLD there is no middleman. Your query is seen by one system instead of several, and no third party gets to attach it to a profile of you.

Varyence operates no backend server for ZenTLD. We do not see your queries. We do not know what names you searched, how often, or whether you searched at all. The application has no account, no sign-in, and no channel to phone home.

Hardened runtime and minimal entitlements

ZenTLD is built with Apple's Hardened Runtime enabled. This prevents code injection, dynamic library hijacking, and process memory tampering by other applications. The app requests no privacy-sensitive entitlements: no Bluetooth, no Location, no Camera, no Microphone, no Accessibility, no Full Disk Access. The only thing ZenTLD needs is ordinary outbound network access to reach the registry servers.

How Varyence develops and ships ZenTLD

Security governance

Our Security Governance Team (SGT) is a cross-functional management team led by the Chief Information Security Officer. The SGT meets regularly to advise, prioritize, and enable the Information Security Program that governs all Varyence software, including ZenTLD.

The risk-driven Information Security Program includes administrative, technical, and physical safeguards aligned with applicable requirements, standards, and best practices. We maintain information security policies that are regularly reviewed, updated, and approved on a predefined schedule. We conduct industry-standard security risk assessments periodically and use vulnerability assessments, penetration testing, and external security reviews to capture the holistic state of our security posture.

People security

Employee background checks. Before onboarding new staff, we perform reference checks. Where local labor law or statutory regulations permit, we may also conduct criminal, credit, immigration, and security checks.

Security training. All Varyence employees and contractors undergo security training as part of the orientation process and receive ongoing security training throughout their tenure. New engineers receive specific training on secure coding practices and automated vulnerability testing tools. We cover phishing, ransomware, and social engineering topics company-wide.

Operational security

Access management. Access rights are based on job function using least-privilege and need-to-know principles. All Varyence personnel use multi-factor authentication and strong passwords. Access to code-signing keys, Apple Developer Program credentials, and production infrastructure is strictly controlled.

Code-signing key protection. The Apple Developer ID Application certificate used to sign ZenTLD is held in a controlled keychain accessible only to authorized release engineers. Notarization credentials are stored in macOS Keychain, not in environment variables or scripts.

Vulnerability management. We administer a vulnerability management process that involves periodic third-party scans using commercially available tools, automated and manual penetration efforts, quality assurance processes, software security reviews, and external audits. Vulnerabilities requiring remediation are logged, prioritized by severity, and assigned an owner.

Malware prevention. All corporate laptops and servers run anti-malware solutions. A safe-link service is used to check links before users click on them.

Monitoring and alerting. Varyence invests in automation of monitoring, alerting, and response capabilities so that potential issues are continually addressed. Engineers and administrators are alerted to anomalies including application attacks, error rates, and abuse scenarios. Automated responses and alerts to appropriate teams are triggered by these and other anomalies.

Encrypting data in transit and at rest

Varyence customer data and our own internal data is encrypted at rest using AES-256 encryption. Data in transit over the Internet, including downloads from zentld.com, is encrypted using TLS 1.2 or higher. The zentld.com website is served over HTTPS with HSTS and modern cipher suites.

Application security

Secure software development lifecycle. Standard best practices are used throughout our development cycle. All code is checked into a permanent version-controlled repository. Code changes are subject to peer review and continuous integration testing to screen for potential security issues. All changes released into production are logged and archived. Access to Varyence source code repositories requires strong credentials and two-factor authentication.

Secure by design. All ZenTLD features are reviewed for security implications during design. We design with security in mind to protect against threats and privacy abuses.

Security testing. We perform internal security testing on ZenTLD and the zentld.com website following the OWASP Testing Guide methodology. Discovered vulnerabilities are prioritized and mitigated.

Third-party vendor management

Prior to engaging any third-party supplier, Varyence assesses the security and privacy practices of the supplier and requires appropriate security, confidentiality, and privacy contract terms.

Regulatory compliance

SOC 2 compliance adheres to standards set by the American Institute of Certified Public Accountants (AICPA) for service organizations, also known as SSAE 18. Varyence is SOC 2 compliant and audited by an independent external auditor.

Customer and user privacy is a primary consideration. As discussed in our Privacy Policy, personal data is never sold to third parties. ZenTLD specifically collects no data at all, as the application runs entirely offline on your Mac.

Reporting a security issue

If you discover a security vulnerability in ZenTLD or in the zentld.com website, please report it responsibly. Email security@zentld.com with:

A description of the issue and its potential impact
Steps to reproduce, if applicable
Any relevant proof-of-concept code or screenshots
Your contact information for follow-up

We will acknowledge receipt within two business days and work with you to validate, prioritize, and remediate the issue. We do not currently operate a paid bug bounty program for ZenTLD but we recognize and credit responsible disclosure publicly when appropriate.

For general security inquiries that are not vulnerability reports, please use help@zentld.com.

If you find zentld.com behaving suspiciously

If you suspect zentld.com has been compromised, do not download any installer offered to you. Instead, verify the published SHA-256 against the value posted in our release notes on Azure Blob Storage (an independent source we control, hosted on different infrastructure from this website). If the two values disagree, the website may have been compromised. Contact us at security@zentld.com immediately.

The strongest defense against a compromised installer is Apple's Notarization service itself. Any installer not signed with the Varyence Developer ID certificate and stapled with a valid Apple notarization ticket will be blocked by macOS Gatekeeper, regardless of where the user obtained it.