Glossary: words used in these docs

A

Access review People and access

A periodic check in which reviewers look at what each person can reach and decide to keep it or take it away. Also called a certification campaign. Run an access review

AI model People and access

The program that writes drafts, summaries and suggestions inside Zonitix. It runs on your own server, and an administrator can switch it off for everyone. Turn AI on or off and choose the model

AlignSync People and access

The screen, under Access Governance in the menu, that compares each person’s details across your connected directories against the one you choose as the source of truth, shows where they disagree, lets you preview a correction before anything is written, and can roll a correction back. Fix directory drift with AlignSync

API and endpoint Technical reference

An API is the set of web addresses a program calls to read or change things in Zonitix, in place of a person clicking in the app. Each of those addresses is an endpoint. API Reference

API token Your server

A long secret that lets a script act in Zonitix as you, without your password. You create one, copy it once, and revoke it when the script is retired. Create an API token

Arm (key escrow) Your server

A one-time permission to cut one backup key into its three shares. One administrator asks for it and a different administrator approves it. Sharing the key out once uses it up. Set up backups

Attestation Compliance

A person stating that a control is met, without a file to prove it. A Compliance Hub setting decides whether that is allowed and whether a note is required. Get started with the Compliance Hub

Audit log Your server

The record of who did what and when. You read it under System, System Logs. Forward logs to your SIEM

Automation mode Workflows and hiring

How much of a pipeline runs without a person: “Runs manually”, “Accounts automatic” or “Fully automatic”. You choose it for each pipeline. Customize a workflow

B

Backup destination Your server

The storage outside your server that backups are copied to. It is either a bucket at an S3-compatible provider (the Back up to list offers Amazon S3, Cloudflare R2, Backblaze B2, Wasabi, Google Cloud Storage and MinIO or another S3-compatible server) or an Azure Blob Storage container. You connect it under System, Backups & Recovery. Set up backups

Backup encryption key Your server

The secret that scrambles your backups before they leave the server. Without it the copies in your bucket cannot be read, so it must be protected off the server. Set up backups

Backup setup lock Your server

A new instance is locked until storage your company owns is connected and a first backup has been read back from it and verified. While it is locked, only the screens needed to finish open (Backups & Recovery, Users, Groups, Roles, Security Settings, System Health, Updates, License & Entitlements and My Profile); an administrator who opens anything else is taken to Backups & Recovery, and everyone else sees “Zonitix is not ready to use yet”. A red banner reads “Zonitix is locked until backups are set up”. Set up backups

Base backup and PITR Your server

A base backup is a larger weekly copy of the whole database. Rebuilding the database as it was at an exact moment between two nightly backups is called point-in-time recovery (PITR). Zonitix keeps what a point-in-time recovery would be built from: a weekly base backup and the record of changes written after it. But no screen and no API call restores your live database to a chosen moment, and you have no login to the server, so a row marked “PITR only” is not something you can restore. What you can restore is a nightly backup whose Restore button works; anything entered after it must be entered again. Restore from a backup

Bearer token Technical reference

A token a program sends with each request, in a header that reads “Authorization: Bearer” followed by the token. Whoever holds the token is treated as its owner, so keep it secret. API Authentication

Bucket Your server

A storage space at a cloud provider, such as Amazon S3, that belongs to your company. Zonitix sends encrypted copies of your backups there. Azure Blob Storage calls the same thing a container. Set up backups

C

Calibration HR and training

An optional step in a review cycle where HR compares ratings across teams, and may change one with a reason, before reviewers can share. Run a review cycle

CIDR range People and access

A short way of writing a block of network addresses, such as 203.0.113.0/24. You use one to allow or block a whole office network instead of one address at a time. Block countries and IP addresses

Closing and locking a month Finance

Checking that a month’s bills are finished, then locking it so nothing dated in that month can change. A correction afterwards is made with a separate adjusting entry. Close the month

Container (service) Your server

One part of Zonitix (sign-in, workflows, finance and so on) running as its own separate program on the server. The app calls each one a container; these guides call it a service. Not the same as an Azure storage container, which is a place backups are kept. Check system health

Control Compliance

One requirement inside a framework: one thing your company has to show it does, such as “laptops are encrypted”. Each control has an owner. Do your compliance tasks

Correlation ID Your server

A code attached to an error message. Quote it to Zonitix support and we can find the matching line in the logs. Contact Zonitix support

Cost centre Finance

A label for the part of the company a cost belongs to, so spending can be added up by team or project. Some screens spell it cost center. Set up and approve a budget

CSRF check Technical reference

A defence against another website making your browser act in Zonitix while you are signed in. Zonitix refuses a browser request that changes something unless it comes from an address it trusts. API Authentication

CSV People and access

A plain table saved as a file, one row per line, that any spreadsheet program opens. Zonitix uses it to bring in lists (such as new users) and to hand lists out (such as reports). Add users

D

Directory People and access

A list of people and their details. Zonitix keeps its own, and your identity provider keeps another; connecting them keeps the two in step. Connect Okta, Entra or Google

Dotted-line manager People and access

A second manager a person also answers to, in addition to their main manager. The org chart shows it as a dotted line. Use the org chart

Drift People and access

When the same person’s details disagree between two directories, for example a different job title in each. AlignSync is the screen that finds and corrects it. Fix directory drift with AlignSync

Dry-run and Enforce Your server

Two settings for a blocking rule. In Dry-run, Zonitix only records what the rule would have blocked. In Enforce, it really blocks. Try a new rule in Dry-run first. Block countries and IP addresses

DSAR (personal-data request) Compliance

A request from a person to see, or to have erased, the personal data a company holds about them. DSAR stands for data subject access request; the GDPR is the European law that gives people this right. Handle a personal-data request

E

eNPS HR and training

A score from a “how likely are you to recommend us, 0 to 10” survey question: the share who answered 9 or 10 minus the share who answered 6 or less. Run an anonymous survey

Enroll Devices

To add a computer to Zonitix by installing the agent on it and approving it. Enroll a device

ERD Technical reference

Short for entity-relationship diagram: a drawing of the kinds of record a system keeps and how they point at each other. Data Model & ERD

Escrow deadline Your server

The date by which both recovery keys, the backup encryption key and the application data key, must be shared out to their trustees: 14 days after the first verified backup, and on an instance in its grace period never before that period ends. Until then a banner counts down to it. If it passes, Zonitix is locked until both keys are shared out. Set up backups

Evidence Compliance

The proof that a control is met: a file, a screenshot or a record Zonitix collects by itself. An auditor reads the evidence, not your word. Do your compliance tasks

Evidence vault Your server

Where Zonitix keeps a copy of a report exactly as it was when it ran, with a fingerprint that proves it has not changed since. Run, save and share a report

F

FileVault and BitLocker Technical reference

The disk encryption built into macOS (FileVault) and Windows (BitLocker). Each has a recovery key that unlocks the disk if the password is lost. The Windows agent sends a BitLocker key to your instance; a FileVault key arrives through Apple MDM. Your instance keeps it encrypted. MDM & Device Operations

Finding Compliance

One problem a Security Lab scan found, with a severity such as Critical or High and a suggested fix. Run a Security Lab scan

Fingerprint Your server

A short code worked out from a key, a token or a file. Two things with the same fingerprint are the same thing, so you can check a key or a report has not changed without seeing its contents. Restore from a backup

Framework Compliance

A published set of security requirements a company can be audited against, such as SOC 2 or ISO 27001. You pick the ones you follow in the Compliance Hub. Get started with the Compliance Hub

G

Gateway Technical reference

The one service on your instance that receives every API request and passes it on to the service that handles it. The rate limits and the CSRF check are applied there. Design Philosophy

Goods receipt Finance

A record that what you ordered has actually arrived, in full or in part. Match bills to purchase orders

Governed list People and access

One agreed list of values that every form picks from, so the same thing is not typed three different ways. Departments are a governed list. The pick-lists for job titles, locations and similar values are kept tidy in the same spirit, under Administration, Data Governance. Departments and naming

Grace period (backup setup) Your server

The 30 days an instance gets if it was already in use when backups to your own storage became a requirement. It is not locked during that time; a banner reads “Backups to storage you own become mandatory on” with the date. If no backup is verified by then, it locks as a new instance does. Not the same thing as the license’s Grace window. Set up backups

Grace window Your server

How many hours your instance may go without a successful heartbeat before the License screen reports the grace as expired. The Heartbeat Health card shows it with “Grace remaining” and “Alert after”; both figures are set by Zonitix. When it expires nothing is switched off: the instance carries on with the last license it confirmed. Read your license and plan screen

Group People and access

A set of people. When a role is attached to a group, everyone in the group holds that role. Roles, groups and permissions

H

Hash chain Technical reference

A way to make a log show tampering: each entry stores a fingerprint that depends on the entry before it, so changing or removing an old entry breaks every one after it. Audit Log & Log Forwarding

Heartbeat Your server

A regular check-in your instance sends to Zonitix to confirm its license and plan. Heartbeat (license check-in)

HMAC signature Technical reference

A short code worked out from a message and a secret that only the sender and the receiver know. The receiver works it out again: if the two match, the message is genuine and was not altered on the way. Your instance signs its license check-in this way. License Verification

Hook, connector and integration People and access

Three words for the same thing: a saved connection between Zonitix and one outside system. The app calls it a hook on the Identity Hooks page, and the button that adds one reads NEW INTEGRATION. Connect an app

HRIS HR and training

Short for HR information system: a separate program some companies keep their people records in. Zonitix can read from one, and HR Settings decides which fields it owns. Choose where people data lives

I

Idempotent request Technical reference

A request that leaves things the same whether it is sent once or several times, so it is safe to send again after a timeout. Error Handling

Identity Hook People and access

The app’s name for a connection between Zonitix and another system, such as your identity provider. You manage them under Access Governance, Identity Hooks. Connect Okta, Entra or Google

Identity provider Signing in

The system that already holds your company’s accounts and passwords, such as Okta, Microsoft Entra or Google Workspace. Sometimes shortened to IdP. Connect Okta, Entra or Google

Instance Your server

Your company’s own copy of Zonitix, on a server that no other customer shares. We host and monitor your server. Zonitix releases are installed automatically in a weekly maintenance window when that is switched on and email is set up, which is the choice pre-selected in the first-run setup wizard; an administrator can apply them by hand instead. Operating-system security patches follow the same window or are applied by hand. Backups and restores are your administrator’s to set up and run. How we provision your instance

Inventory Devices

The list of every computer enrolled in Zonitix, with what each one last reported about itself. You find it under Devices, Inventory. Manage a device day to day

J

Journal and GL code Finance

A journal is an accounting entry: a line saying which account a cost was booked to. A GL code (general ledger code) is the number of that account. Closing a month writes the journals, and you export them for your accounting software. Close the month

JSON Your server

A plain-text file format meant for another program to read, not a person. Some downloads and some connection keys come as a JSON file. Export all your company data

K

Key escrow and trustee Your server

Key escrow is a way to keep a key safe off the server: it is split into parts and three people you choose, the trustees, each hold one. Any two of them together can rebuild it. Set up backups

Knowledge check HR and training

A few questions at the end of a course. You need to reach the pass mark for the course to count as done. Do a training course you were given

L

LDAP Technical reference

A long-established standard for reading and changing a company directory. Zonitix can connect to a directory that speaks it. Identity Hooks

Learning path HR and training

Several courses in a fixed order. Each person gets the next one when they finish the one before. Build a learning path

M

Maintenance window Your server

The weekly day and time at which automatic updates are allowed to run, set under System, Updates in the Automatic schedule window. A new instance starts with the one chosen on the setup wizard’s Updates step. Administrators are emailed a day before, an hour before, at the start and at the end. Apply updates

MDM (mobile device management) Devices

The built-in way a computer’s maker lets a company lock certain settings so the person using it cannot change them. On a Mac, the screen lock and disk encryption (FileVault) are locked this way. Push a compliance profile

MFA (multi-factor authentication) Signing in

A second proof that it is really you, on top of the password: usually a six-digit code from an authenticator app on your phone, or a passkey. Turn on MFA

O

OCR Technical reference

Short for optical character recognition: reading the text out of a picture or a scanned PDF. Zonitix uses it to read the bills you upload. Reading Bills (OCR Extraction)

Off-box Your server

Stored somewhere other than your Zonitix server: in storage that you own, called the backup destination. An off-box backup survives even if the server itself is lost. Set up backups

OIDC and SAML Signing in

The two standard ways an identity provider tells another application who has just signed in. Zonitix accepts either; you pick the one your identity provider offers. In the app the setting is called “SSO (OIDC / SAML)”. Turn on single sign-on

OpenAPI Technical reference

A standard file format that lists endpoints of an API so a program can read them. Your instance publishes one for part of its own API. API Reference

Orchestration Workflows and hiring

The reference pages’ word for how workflows are run: Zonitix moving each run from one step to the next, and waiting where a step needs a person. How Workflows Run (Orchestration)

Orphaned account People and access

An account that exists in one of your connected directories with no matching person in Zonitix. AlignSync lists them under Directory hygiene as “Orphans in IdP”, next to missing users and status mismatches. Fix directory drift with AlignSync

P

Passkey Signing in

A sign-in key kept by your phone, your computer or a small security key, and unlocked with your fingerprint, your face or a PIN. There is nothing to type and nothing to remember. Your profile and sign-in security

Password Change Required Signing in

The window that opens at sign-in when an administrator has expired your password or a password rule has changed. You choose a new password there before you can go on. Apart from accepting an invitation, it is the only place a person sets a password for themselves. Password policy and sessions

Payload (body) Technical reference

The data sent with a request or returned in a response, written as JSON. API Reference

Permission People and access

One thing a person is allowed to do, such as view users or approve an invoice. You rarely hand out permissions one by one; they come bundled in roles. Roles, groups and permissions

Persona (blueprint) People and access

What a job role gets on day one: its apps, licences and hardware. You define it once under Administration, User Personas, and onboarding uses it for every new person in that role. Create a persona

Phishing simulation HR and training

A practice email, made to look like a scam, that your own company sends to its staff to see who clicks and who reports it. It is a test, not a real attack. Run a phishing simulation

PII and SAR Compliance

Two abbreviations on the personal-data button in My Profile. PII means personal data; SAR means a request for a copy of it, the same thing as a DSAR. Handle a personal-data request

Pipeline Workflows and hiring

The app’s word for one named workflow, such as your onboarding pipeline. The search box on Workflow Tasks reads “Search name, email or pipeline”. Customize a workflow

Placeholder Workflows and hiring

A name in double curly brackets in an offer letter template, such as {{CandidateName}}. Zonitix swaps it for the real value when the offer is sent. Write an offer letter template

Plan and entitlement Your server

Your plan is the subscription you are on: Core, Team or Advanced. An entitlement is one feature that plan switches on. The page that shows both is System, License & Entitlements. Read your license and plan screen

PostgreSQL and Redis Technical reference

Two programs that run on your server beside Zonitix. PostgreSQL is the database that holds your records. Redis is a small, fast store kept in memory. Transport & Service Trust

Primary administrator People and access

The first account, created by whoever completes setup. The setup screen calls it the “primary Super Administrator”. It is protected: it cannot be offboarded or deleted from the Users page. When your main administrator leaves

Profile Devices

A set of settings applied to computers, such as turning on the firewall. On a Mac enrolled in Apple MDM a profile can also lock the screen lock and disk encryption. Push a compliance profile

Provision and deprovision People and access

To provision is to set something up for a person: an account, a licence or a device. To deprovision is to take it away again when they no longer need it or leave. Handle access requests

Purchase order (PO) Finance

A record of what you agreed to buy and at what price, made before the bill arrives. Zonitix compares each bill with its purchase order. Match bills to purchase orders

Q

Queue Workflows and hiring

The list of steps waiting for one team. Workflow Tasks has an HR queue, an IT queue and a Manager queue. Work through workflow tasks

Quorum Technical reference

How many people out of a set must act together before something happens. In key escrow the quorum is two of the three trustees. Key Escrow & Recovery

R

Rate limit Technical reference

A cap on how many requests one caller may send in a set time. A caller over the cap is refused until the time has passed. Rate, Size & Time Limits

RBAC (role-based access control) People and access

Deciding what people may do by the roles they hold, instead of person by person. It is the model behind the Roles, Groups and Access Control pages. Roles, groups and permissions

Readiness score Compliance

The share of a framework’s controls that currently pass on collected evidence or on a review by a second person. It is the ring on the Compliance Hub overview. Get started with the Compliance Hub

Recovery code Signing in

A one-time code you save when you set up MFA, for the day you do not have your phone. Each code works once. Your profile and sign-in security

Recovery Kit Your server

An offline tool you download from the Key escrow card and send to each trustee. They use it to create their own key file and, when the day comes, to rebuild the key together with a second trustee. Set up backups

Request, response and status code Technical reference

A program sends a request to an endpoint and gets a response back. The response carries a three-digit status code: 200 means it worked, a code starting with 4 means the request was refused, and one starting with 5 means the server failed. API Error Troubleshooting

Requisition Workflows and hiring

A request to hire for a role. In the app each requisition is a job posting. Hire someone

Restore point Your server

A backup of the database that you can roll back to. They are listed under System, Backups & Recovery. Restore from a backup

Review cycle HR and training

One round of performance reviews for a group of people: a self review from each person, a review from their reviewer, and the moment the two are shared. Complete a performance review

Role People and access

A named bundle of permissions, such as administrator or hr_manager. Giving someone a role gives them everything in the bundle. Roles, groups and permissions

Run Workflows and hiring

One pass through a workflow for one person, for example the onboarding of one new hire. Ten new hires means ten runs. Work through workflow tasks

S

SCIM Signing in

A standard that lets your identity provider create, update and switch off people in Zonitix by itself, as they change there. In the app the setting is called “Provisioning (SCIM)”. Push users with SCIM

Scope (Security Lab) Compliance

The list of your own hosts that Security Lab is allowed to test. A host that is not in an enabled scope is refused. Run a Security Lab scan

Scorecard Workflows and hiring

An interviewer’s written result for one interview: a rating for each question, a recommendation and a short summary. Run an interview and submit your scorecard

Seat People and access

One person’s licence for an app. An app with 40 seats is paid for 40 people, whether or not all 40 use it. Track what you spend on software

Separation of duties People and access

A rule that the person who asks for something cannot be the person who approves it. Zonitix applies it to access requests, workflow approvals, offers, bills and restores. Finance screens call it segregation of duties. Handle access requests

Session Signing in

The time you stay signed in on one browser before Zonitix asks you to sign in again. Password policy and sessions

Session token (JWT) Technical reference

A signed piece of text your browser holds after you sign in. It proves who you are on every request until the session ends. JWT is the name of its format. API Authentication

SHA-256 checksum Compliance

A long code of letters and digits worked out from a file. If the file changes, the code changes, so two matching codes show that a download is complete and was not changed on the way. Export all your company data

Share (key escrow) Your server

One of the three parts a key is cut into for key escrow. Each trustee holds one, and any two shares rebuild the key. Be a trustee for a backup key

SIEM Your server

A security monitoring system that collects logs from many systems in one place. If your company has one, Zonitix can send its audit log there. Forward logs to your SIEM

Sign-in link Signing in

A link Zonitix emails you that signs you in without a password. Some pages call it a magic link. It only works when email is set up. Set up email

SLA (Finance approvals) Finance

On the Finance Approvals tab, the SLA column is how many days a bill has been waiting for a decision. From seven days the screen marks it SLA breached. It is a reminder inside your own company, not a commitment from Zonitix. The letters mean two other things in these docs: see SLA (Security Lab) and SLA (uptime). Capture and approve a bill

SLA (Security Lab) Compliance

On a Security Lab issue, the SLA is the date the issue should be fixed by, counted from the day it was first seen: 7 days for Critical, 14 for High, 30 for Medium and 90 for Low. A weakness known to be under attack can bring the date forward. An open issue past its date is overdue. It is a deadline inside your own company, not a commitment from Zonitix. Security Lab

SLA (uptime) Your server

Short for service level agreement: a supplier’s written commitment to how much of the time its service will be available. Zonitix publishes no uptime SLA. On two screens of the app the letters mean something else, a deadline inside your own company: see SLA (Finance approvals) and SLA (Security Lab). Failure Modes

SMTP Your server

The standard way a program hands email to a mail server. “Set up email” means giving Zonitix your mail server’s SMTP details. Set up email

Snapshot Your server

A saved copy of how something looked on a given date, kept so you can compare it with today. The org chart and the cloud map both keep them. Use the org chart

SOC 2 and ISO 27001 Compliance

Two widely used security standards, and two of the frameworks you can pick in the Compliance Hub. For SOC 2 an independent auditor reports on how a company’s security controls work; ISO 27001 is an international standard a company is certified against. The audit itself is done by an outside auditor, not by Zonitix. Get started with the Compliance Hub

SSO (single sign-on) Signing in

People sign in to Zonitix with the account they already have at your identity provider, so there is no separate Zonitix password to remember. Turn on single sign-on

Static group and smart group Devices

Two kinds of device group. A static group holds exactly the machines you pick. A smart group holds whichever machines match a rule, worked out again from each machine’s last report whenever the group is read. Group devices

Step Workflows and hiring

One piece of a run that a person or team has to finish, such as IT preparing a laptop. Steps waiting for you are listed on the Workflow Tasks page. Work through workflow tasks

Step-up (Sudo Mode) Signing in

Before a sensitive action, Zonitix asks you to prove it is you again, in a window titled “Sudo Mode Required”. The proof stays good for 15 minutes, and that time is called the step-up window. It is the same on every instance: no screen changes it. Some pages write “sudo” or “re-authentication” for the same thing. MFA enforcement (reference)

The store Your server

The reference pages’ name for Zonitix’s own licensing service, the system at Zonitix that holds your subscription. Your instance checks in with it (the heartbeat) to learn which plan and features it has. Heartbeat (license check-in)

Swap Your server

Overflow space on the server’s disk, used when memory is full. It is much slower than memory, so high swap use means the server is short of memory. Check system health

Sync and dry run People and access

A sync copies the current list of people and groups from a connected system into Zonitix. A dry run shows what a sync would change without changing anything, so you can check first. Connect Okta, Entra or Google

T

Tenant People and access

Microsoft’s word for one company’s own space in Entra or Azure. Zonitix asks for its “Directory (tenant) ID” when you connect Entra. Connect Okta, Entra or Google

TLS Technical reference

The encryption that protects data while it travels between a browser or a program and a server. An address that starts with https is using it. API Authentication

TOTP Technical reference

The six-digit code from an authenticator app, which changes every 30 seconds. The letters stand for time-based one-time password. MFA Enforcement

Trigger Workflows and hiring

The first step of a pipeline: what starts it. Zonitix checks that the trigger comes first before a pipeline can go live. Customize a workflow

Trusted device Signing in

A browser where you ticked “Trust this device for 30 days” when you signed in, so it does not ask for your second factor each time. You can see and revoke yours on My Profile. Your profile and sign-in security

U

UTC Your server

The world’s reference clock, the same everywhere, with no summer-time change. Where a setting gives an hour in UTC, such as 09:00 UTC, work out what that is in your local time before you choose: in most countries it is a different hour on the clock. Set up training

V

Vendor and alias Finance

A vendor is a company you pay. An alias is another spelling of its name that appears on its bills; listing aliases lets Zonitix file every bill under the one vendor. Tidy your vendor list

VPS Your server

Short for virtual private server. It is the app’s word for the server Zonitix hosts for you: the System Health page says “The VPS is under heavy load.” when it is short of processor, memory or disk. Check system health

Vulnerability probe Technical reference

An automated check that looks for one common kind of security weakness on your instance. The Security Lab runs them when you start a scan, or on a schedule you turn on. Vulnerability Probes

W

WAL (write-ahead log) Technical reference

The running record of every change a database makes. Point-in-time recovery is built from it. Backup, Restore & Updates

WebAuthn Technical reference

The web standard behind passkeys. The reference pages use this name where the guides say passkey. MFA Enforcement

Webhook Your server

A web address in another system that Zonitix sends something to, such as a scheduled report or your audit log. You paste the address into Zonitix; the other system gives it to you. Run, save and share a report

Workflow Workflows and hiring

The ordered list of steps your company follows for something repeatable, such as onboarding a new hire or offboarding a leaver. Customize a workflow

Z

Zero-touch Workflows and hiring

The reference pages’ name for the hand-off from a signed offer to onboarding: when a candidate signs their offer, the onboarding run for them starts without anyone typing their details in again. People still approve their steps. Signed Offer To Onboarding (Zero-Touch)

Zonitix Agent Devices

A small program you install on a Mac, Windows or Linux computer. It reports the computer to Zonitix and carries out the commands and settings you send. Enroll a device

Where next

• When something goes wrong
• Contact Zonitix support
• All guides