Coming Q3 2026 · Limited Founding Cohort

Continuous AI security
for orgs that can't afford a CISO.

Zentarai Secure runs autonomous AI security audits on your websites, APIs, and cloud infrastructure — 24/7 — and translates findings into plain-English reports your team can actually act on. Built for Philippine SMBs, LGUs, and startups that need real security without enterprise budgets.

Get Early Access How it works

24/7

Continuous Scans

<15min

Critical Alert SLA

RA 10173

DPA Compliant

The Reality

Most SMBs and LGUs are one breach away from disaster.

Hiring a security team costs ₱3–6M/year. Bug bounties miss everything. Annual audits are stale before the report is delivered. There's a gap — and that's where Zentarai Secure lives.

87%

of PH SMBs have no dedicated security staff

DTI 2025 Cybersecurity Readiness Index. Most rely on the dev who built the site.

₱4.2M

average cost of a single PH data breach

IBM Cost of a Data Breach 2025 (PH-segment). Add NPC fines for RA 10173 violations.

11 days

median time to detect a breach in mid-market PH orgs

By the time anyone notices, the data is already on Telegram channels.

What It Does

A security team — automated.

Six AI agents working around the clock. They don't sleep, don't quit, don't miss the obvious things humans miss when they're tired at 2 AM.

Continuous Surface Scans

Subdomains, exposed endpoints, leaked credentials, misconfigured S3/R2, open admin panels — found before attackers find them.

Daily subdomain enumeration
Public secret scanning (GitHub, paste sites)
Cloud misconfig detection

API & App Vulnerability Tests

OWASP Top 10, broken auth, IDOR, injection, CSRF — tested against your live endpoints with safe payloads. No production downtime.

OWASP Top 10 + API Top 10
Auth bypass attempts
Rate-limit and CORS audits

Credential & Secret Hygiene

We watch your repos, env files, and public surfaces for leaked tokens, API keys, and passwords. When something leaks, you know in minutes — and we walk you through rotation.

Gitleaks pre-commit hooks (free)
Daily secret-rotation reminders
1-click rotation runbooks

Plain-English Reports

No jargon. No CVE numbers without context. Every finding includes: what it means in human terms, what an attacker could do, and exact steps to fix — with code samples.

Risk score (0–10) per finding
Business-impact translation
Copy-paste fix snippets

Compliance Posture

Continuous mapping to RA 10173 (Data Privacy Act), BSP MORB cyber rules, NPC circulars, and SOC 2 controls. One dashboard, all frameworks.

RA 10173 / DPA gap analysis
BSP cyber-resilience scoring
Audit-ready evidence pack

Incident Response Playbook

If something breaks at 3 AM on a Saturday, you have a runbook. We pre-build IR procedures specific to your stack, your team, your obligations under the DPA.

Pre-built IR runbooks
NPC notification templates (72h rule)
Tabletop exercise quarterly

Setup in 30 Minutes

How Zentarai Secure works.

No agents to install. No long onboarding. Point us at your domains and repos — we take it from there.

Point us at your stack

Domains, API endpoints, GitHub orgs, cloud accounts (read-only). 30 minutes total.

Baseline scan

First full audit completes in 24 hours. You get a posture score (0–100) and the top 10 things to fix.

Continuous monitoring

Daily light scans, weekly deep scans, monthly full audit. Critical findings paged to your phone in <15 min.

Fix with confidence

Every finding ships with copy-paste remediation. Verify the fix worked with one click — we re-scan immediately.

Pricing — Founding Cohort

Locked in for 12 months.

First 25 customers get founding pricing — locked for one year. After that, Q3 2026 pricing applies.

Starter

₱4,900per month · 1 domain · 1 API

For solo founders, small SMBs, and barangay-level LGUs. Get the basics right.

Continuous surface scans
OWASP Top 10 testing
Secret leak monitoring
Monthly plain-English report
Email + Slack alerts

Join Waitlist

Join the Founding Cohort

25 spots. Locked-in pricing for 12 months. First-look at every feature we ship. Tell us what you need most and we'll prioritize it.

We email once or twice a month. No spam, ever. Reply STOP and you're off.

Common Questions

FAQ

Will scans break my production site?

No. We use safe payloads only — no destructive tests, no DoS, no rate-bombing. We auto-throttle. You can also schedule scans for off-hours, and any test against a sensitive endpoint requires explicit allowlisting first.

What if you find something critical?

You get paged immediately — Slack, email, and SMS — within 15 minutes of detection. The alert includes severity, business impact, and a remediation runbook. For Business tier and above, our on-call analyst can join your incident channel within 1 hour.

How is this different from a one-time pentest?

Pentests are snapshots. By the time the PDF lands, your code has changed and the threat landscape has moved. Zentarai Secure is continuous — we catch the regression a developer introduced this morning, not in next year's audit.

Do you handle the actual fixes, or just report them?

For Starter and Business, we report findings with copy-paste remediation steps — your team applies them. For Government / Enterprise, we can deploy a fractional security engineer who handles fixes for you.

Are you compliant with the Philippine Data Privacy Act?

Yes — Zentarai Labs is a registered Personal Information Controller and Personal Information Processor under RA 10173. We hold no production data; all scans are read-only. Findings are encrypted at rest (AES-256) and in transit (TLS 1.3). We sign DPAs with every customer.

Who runs Zentarai Secure?

Zentarai Labs LLC (Florida) — the same team that builds Nova Gov for Philippine LGUs and Nova Solutions for SMBs. Our security practice grew out of the work we do hardening our own customer-facing infrastructure.