Zeo uses least-privilege access, tenant isolation, private artifact storage, and server-side signed URLs for downloads.