Security
Built to refuse by default
Every company's data is walled off twice. Every request is checked against the person's permissions. Every change is recorded. Here is how, in plain terms.
Each company walled off
Every query filters on the caller's organisation. Row-level security in the database is the second wall, and it fails closed.
- With no organisation set, the database shows and accepts no company's rows at all
- The setting lasts one transaction, so a pooled connection never carries a company to its next user
- Tests check isolation route by route, and fail if a table is left out
- A session from one workspace is refused in another
Sign-in that resists guessing
Passwords are hashed with Argon2id. Repeated failures lock the account, and authenticator codes add a second factor.
- 8 failed attempts lock the account for 15 minutes
- Authenticator app (TOTP) codes accepted once only, with 10 single-use recovery codes
- Required for everyone who uses the admin console; your company can require it for all staff
- Unknown email and wrong password get the same answer
Sessions that can be revoked
Each device has its own session. Refresh tokens rotate on every use, and a reused one ends the session as a sign of theft.
- Short-lived access tokens; permissions are looked up on every request
- Suspending a person ends every session at once
- HttpOnly cookies that page scripts cannot read
- Writes refused without our origin and app header, which blocks cross-site requests
Roles, scopes and no escalation
Roles are bundles of permissions, each with a reach: own records, team, region or the whole company. Per-person overrides exist, and a deny always wins.
- A record outside your reach answers "not found", so ids cannot be probed
- Nobody grants a permission or scope they do not hold
- Nobody approves their own won deal or out-of-radius check-in
- Administrative permissions work only in admin-console sessions
Secrets encrypted at rest
Integration keys, authenticator secrets and mailbox credentials are encrypted with AES-256-GCM. They are never returned by the API and never written to the audit log.
- After saving, only the last four characters of a key are shown
- Calls to your Odoo go only to the address your administrator entered, over https
- Logs redact cookies, tokens and passwords
- Company exports keep encrypted columns as ciphertext
Every change on the record
Each administrative and business change is written with its field-level difference, who made it, the session, IP address and device, in the same transaction as the change.
- If the change is saved, its audit entry is saved with it
- Consent to location tracking, given or withdrawn, is audited
- Platform operators' actions go to their own log
- Odoo sync activity is logged and kept for 90 days
Plan limits enforced in the API
Seats, storage, AI requests and modules are checked by the server under locks, so parallel requests cannot go past a limit.
- An invitation holds its seat until it is used or withdrawn
- Switching a module off removes its permissions from everyone
- The organisation always keeps at least one active administrator
Retention and deletion
Data is kept as long as its purpose needs. A company that leaves can be deleted completely.
- Location track points: 90 days by default, at most 365
- Odoo sync log: 90 days
- Workspace deletion is scheduled with a grace period (30 days by default) and can be cancelled until then
- After it, every row and stored file of the company is removed, leaving only a record that the deletion happened
Location tracking
Only with consent, only in working hours
Working-hours tracking lets a supervisor replay a rep's day. It collects as little as that purpose needs, and only with the person's own say-so.
- Off by default
- An administrator switches it on for the company. The consent requirement cannot be switched off: the setting refuses it.
- Each person decides
- Nobody is tracked until they agree themselves. No administrator or manager can agree for them. They can withdraw at any time, and both answers are audited.
- Inside the window only
- Points are accepted only during the company's working hours on working days, on the person's own clock. Evenings and days off are never stored, whatever the phone sends.
- Who can see a journey
- A person sees their own journey. Others see it only when the person is in their attendance reach. There is no company-wide live map beyond the existing last-seen view.
- Kept for a set time
- Track points are deleted after 90 days by default, at most 365. Withdrawing consent stops collection at once; what was already recorded stays until its retention ends.
- Evidence, with its limits
- Simulated positions are flagged and counted, and impossible jumps or imprecise fixes are left out of the route. Tracking shows where a phone was, not proof of where a person was.
Mailboxes
Your mail stays yours
Each person connects their own mailbox. Nobody has a permission to read anyone else's mail, administrators included.
- The owner reads it in full
- Colleagues, a manager included, see a thread only when it is linked to a record they can see, and only as far as the owner's sharing level allows: participants and times, plus the subject by default.
- Bodies only when shared
- A colleague sees a message's body only when the owner shares that thread. AI summaries, drafts and suggestions are never shown to anyone else.
- Nothing loads from outside
- Incoming HTML is cleaned: no scripts, forms, frames or images, so no tracking pixel is ever fetched. Attachments are described, never downloaded.
- The AI proposes, you decide
- Mail text given to the AI is treated as data, not instructions. Its drafts and suggestions are proposals: nothing is sent or created without the owner's say.
- Credentials encrypted
- Google and Microsoft grants and IMAP app passwords are encrypted, never returned and never audited. Mail is a separate grant from the calendar.
- Disconnect deletes
- Disconnecting a mailbox removes its mail from Zaps. Mailbox servers typed by people are checked, and private or internal addresses are refused.
What we do not claim
This page describes how the software is built and what it enforces. It is not a certification. For questions about hosting, sub-processors or a security review, talk to us.
See your team's day, the way it happened.
A 30-minute walkthrough on your own process: visits, journeys, quotations and the inbox, in Arabic or English.
14 days free · No card needed · Launch prices from 39 SAR