Trust and security at ZeroReach

Where we are

• ZeroReach has no security certification yet: no SOC 2, ISO 27001 or independent audit. We will say so here when that changes.
• We do not yet publish a standard data processing agreement. Contact us if you need one.
• Anything that reaches a customer (emails, replies, calls) waits for approval by default. Automatic sending is an explicit admin opt-in.

Security

• Passwords are hashed with Argon2. Sign-in uses short-lived access tokens and a refresh token in an HttpOnly cookie; signing out or changing a password ends sessions.
• Every table that holds customer data carries a workspace id, and every query filters on it.
• Roles (owner, admin, member) limit who can do what. API keys have scopes, act as the user who created them and never exceed that user's current role. Keys are stored only as a SHA-256 hash and shown once.
• Provider secrets, such as connected mailbox credentials, are encrypted at rest (Fernet: AES-128 with HMAC-SHA256) with rotatable keys.
• Outbound webhooks are signed. Requests to customer-supplied URLs are checked against private networks (SSRF protection) on every use.
• Sign-in, sign-up and sending are rate limited.

Audit log

• Every change made in the app, through the API or by an AI assistant over MCP is recorded: who, when, which action and the result, including denied requests.
• The log stores the route, never the request body, so no customer data or secrets end up in it.
• Audit events are kept for 90 days by default; the retention is configurable.

Data handling

• Your workspace data is stored in Postgres. Large tables are partitioned by month with configurable retention; the lead timeline is kept unless you set a retention.
• Exports are built in the background, downloaded through a signed link valid for 15 minutes and deleted after a set time.
• Files attached in the assistant are limited in size and deleted after 30 days.
• AI models that may train on prompts (such as some free tiers) are never offered by default. A workspace admin must allow them explicitly, after a warning.
• Calls start with a disclosure that the caller is an AI agent.

Privacy requests

ZeroReach supports the rights to access and erasure under the GDPR and India's DPDP Act, per lead and per workspace. Every request is recorded.

• Export one lead's data as JSON: their record, timeline, consents, emails, calls, research, memory and more.
• Erase one lead in a single transaction, including emails, calls, knowledge-graph facts about them and copies in exports. A hashed suppression is kept so they are never contacted again, without storing the address.
• Export a whole workspace, or delete it.
• Any signed-in user can download their own account data.
• Copies held by outside providers (your mailbox provider, voice and AI providers, webhook receivers) must be erased there too.

The compliance engine

Before any email, call, SMS or LinkedIn message, the backend decides whether the person may be contacted on that channel. The rules are code with tests, applied on every outbound path.

• Suppression lists by email, phone, LinkedIn URL and domain, on all or some channels.
• A consent ledger: the latest revocation wins, and channels that need consent are blocked without it.
• Calling windows in the lead's local time, public holidays and call-frequency caps, with rule packs for the US, UK, EU and India that admins can tighten.
• Contact-pressure caps: how often one person, company or recipient domain is touched across all channels.
• Signed one-click unsubscribe links and a postal address in marketing emails.
• Bounces, complaints and unsubscribes feed back into suppressions automatically.

Sub-processors

These services may be used to provide ZeroReach, depending on configuration and on which features and providers a workspace turns on. This list is not final and will change before general availability.