Security and data

What we do with your data, stated plainly.

Only claims we can stand behind today. Where a certification is in progress we say so, with the stage it is at, no badges we have not earned.

Where data is hostedIndian customers on infrastructure in Mumbai; everyone else in Frankfurt. You choose the region at signup and it does not move afterwards.
EncryptionTLS 1.3 in transit, AES-256 at rest, including document storage and backups.
BackupsContinuous, with point-in-time recovery for 30 days. Restores are tested monthly.
Access controlsRole-based permissions per module, per record type. Sensitive HR fields are restricted by default.
Staff access to your dataSupport cannot read your records without a time-boxed grant you approve in the app. Every grant is logged and shown to you.
Audit trailEvery create, change, delete and AI read is attributed and retained. Exportable by admins.
AvailabilityMeasured and published monthly. We report the real figure rather than an aspirational one.
Data export and deletionCSV per module or a full JSON archive, any time. Deletion on request completes within 30 days, backups included.

How AI access is permissioned and logged.

An assistant is treated like a member of staff with unusually narrow permissions and an unusually complete log.

Scoped

Each connection reads only the modules and record types you tick. Default is nothing.

Attributed

Reads are logged against the connection name, not a generic service account.

Approval-gated

Anything that leaves the company waits for a human to release it.

Revocable

One click ends a connection and the assistant loses access immediately.

Compliance status

SOC 2 Type IIIn progressControls implemented; observation window begins Q4 2026.
GDPRCompliantDPA available on request; EU hosting for EU customers.
India DPDP ActCompliantData residency in India for Indian customers.
ISO 27001Not yetPlanned after SOC 2. We will not claim it before the certificate exists.
Penetration testAnnualThird-party test; summary letter shared under NDA.

Security questions from a buyer's team: security@zlyntoffice.com. We answer questionnaires without requiring a sales call.

Security questions

Indian customers are on infrastructure in Mumbai and everyone else in Frankfurt. You choose the region at signup and it does not move afterwards.
TLS 1.3 in transit and AES-256 at rest, including document storage and backups.
Not without a time-boxed grant that you approve inside the app. Every grant is logged and shown to you, so support access is a visible event rather than a standing permission.
Backups are continuous, with point-in-time recovery for 30 days. Restores are tested monthly, an untested backup is not a backup.
Yes. Permissions are role-based per module and per record type, and sensitive HR fields are restricted by default rather than opened by default.
Yes. An agent's reads and writes are attributed to its name the same way a teammate's are, and appear in the same audit trail.
Your data stays yours

Read the detail, then try it on real records.

Export anything at any time. 14-day free trial, no credit card, no lock-in.

Start free trial14-day free trial · No credit card required