Legal/Security

Security

Zatio is built for businesses handling customer data. We take security seriously across infrastructure, people, and process.

Infrastructure

  • Hosting: Supabase (database and files, EU, Stockholm) and Vercel (application; functions execute in the EU, Stockholm, served through a global edge network)
  • Voice: live call audio runs through our voice bridge on Fly.io (EU, Frankfurt) and is not stored
  • AI processing: Anthropic (text) and Google (voice) may process data outside the EU under EU standard contractual clauses
  • Encryption in transit: TLS 1.2+ for all connections
  • Encryption at rest: the database and its backups are encrypted at rest by Supabase (AES-256)
  • Network: all public endpoints are served over HTTPS

Access control

  • Zatio staff access is limited to a short, explicit list of named accounts set in our server configuration
  • Inside your account, each team member has a role (owner, admin, member or viewer) that sets what they can see and change
  • When our team opens your account to help you, that session is tied to your account only and expires after 30 minutes
  • Errors and security warnings are reported to our error monitoring so we can act on them quickly

Secrets and credentials

  • Platform keys (AI, telephony, payments) live in our hosting provider’s encrypted environment settings, outside the code
  • Credentials you connect to Zatio are encrypted in our database with AES-256-GCM: WhatsApp access tokens, Twilio sub-account tokens, Cal.com API keys, Calendly tokens and webhook signing secrets

Data isolation

  • Each Operator’s data is logically isolated at the database layer (row-level security)
  • No cross-tenant data access

Sub-processors

See our Privacy Policy for a current list of sub-processors. Data Processing Agreements are in place with all sub-processors.

Incident response

If a personal data breach affects your data, we notify you without undue delay, and in any event within 72 hours of becoming aware of it, as our Data Processing Agreement sets out.

Report a security issue: security@zatio.io

Compliance

  • UK GDPR and EU GDPR
  • Spanish LOPDGDD
  • EU AI Act (Art. 50, AI transparency)
  • WhatsApp Business Policy and Meta Platform Policies

Contact

Security enquiries: security@zatio.io

Responsible disclosure

Found an issue? Email security@zatio.io and we acknowledge within 24 hours.