Security, without the buzzwords
You’re about to trust someone else’s system with your customers’ conversations, contracts and recordings. Here’s what protects them and what keeps them apart from other companies’ data.
How the data is kept apart
Isolation in the database itself
Every record knows which company it belongs to, and that condition is part of the database query itself. Other companies’ data is never loaded, so it can’t be shown by mistake.
Your credentials are encrypted
Mailbox passwords and the keys for your channels and telephony are stored encrypted with AES-256. They’re decrypted only at the moment of use and never reach the browser.
Files aren’t in a public folder
An attachment can’t be opened by guessing its address. Each one opens through a signed link that is valid for five minutes, and only from the IP address that requested it.
Two-step sign-in
With a code from an authenticator app, plus backup codes in case the phone is lost. It can be switched on for every account.
The session ends with the browser
Close the browser and you’re signed out. That’s deliberate: the working day starts with a sign-in, not with a session left open since yesterday.
Every event is applied once
A notification delivered five times changes your data once. Repeat deliveries are normal on the internet; duplicate tickets and double-counted calls are not.
Specifics
- Credential encryption
- AES-256
- In transit
- TLS with HSTS
- File links
- 5 minutesand only for the IP address that requested them
- Two-step sign-in
- TOTP6-digit code that changes every 30 seconds; backup codes
- Roles
- admin, operator, HRplus supervisor as a department role; each person sees only what their role allows
- Longest server session
- 7 days
- Incoming notification check (webhook)
- HMAC-SHA256a signature over the raw data, valid for 5 minutes
- Backups
- encrypted before they leave the server
- Restore
- tested in practiceregular restores into a temporary database, with the rows counted
What we don’t claim
ZynTrail has no ISO 27001 or SOC 2 certification. We say so here in one line, so you don’t find out halfway through a vendor selection.
What we do have is described above: the mechanisms, and proof that they work in practice. Backups are restored on a schedule into a temporary database and the rows are counted, because a backup nobody has ever restored is a hope, not a backup.
If your process requires a document we can’t provide, tell us early. Better to have that conversation in week one than in week ten.
The legal side
You are the data controller
The personal data in your tickets is yours. ZynTrail processes it only on your instructions and under terms set out in the contract.
The processing agreement is included
The Article 28 GDPR agreement is part of the Terms of Service and is accepted with them. If your process requires it, you can also have it as a separate document to sign.
Erasure is carried out
An erasure request is carried out in the live system. Backups holding the old record aren’t edited; they expire on a published schedule.
What the law requires, stays
Invoices and accounting documents are kept for as long as tax and accounting law requires, even after an erasure request. We always tell you which law and for how long.
Security questions
Can’t find the answer? Write to hello@zyntrail.com
Can ZynTrail run on our own server?
No. ZynTrail is a cloud service that we run: we update it, make the backups and test the restores. The software isn’t installed on customers’ servers.
That’s a big part of what you pay for: no server to maintain, no weekends lost to upgrades, and a backup that someone has actually restored.
Who at ZynTrail can see our tickets?
The platform’s service account has access to companies’ data, because we use it to create companies, fix a broken mailbox connection and troubleshoot errors.
Only a few people have access to it, and if you ask, we’ll name them.
What happens to our data if we leave?
You export your tickets, customers, contacts and schedules to CSV (customers to Excel as well), and then we delete the company along with everything connected to it.
Backups already made are kept until they expire on the published schedule.
See how it would work for your team
Tell us how many people answer customers and how your customers reach you. We’ll show you the screens your team would work in — with your own cases, not a made-up script.
Start with 30 days free — every feature, nothing to pay up front.