Security at ZeroDelay

Your data stays in your systems. ZeroDelay reads the figure someone asks for, sends it to them, and keeps only a reference.

• Roles and scopes. Every person has a role (owner, staff, dealer, supplier) and a scope. Access is checked before and after every query.
• Fixed questions, not free access. The AI only chooses which approved question is being asked. It never receives answers from your systems and cannot run free-form queries.
• Approval before anything is written. Entries from chat become drafts that someone you choose approves.
• Encryption. TLS in transit; encryption at rest with a separate key per client.
• Credentials in a vault. API keys and tokens are encrypted with a key unique to your company and kept in a secrets vault, apart from your other data. They never appear in logs or email.
• Audit log. Who asked what, and when, is logged for one year and available to you. What console admins and our operators change or view (exports, photos, people, leads) is logged too, without the values, and cannot be edited.
• Where it runs. By default, ZeroDelay is hosted by NSDBytes on cloud servers in India. On request, and at the client's cost, we set up a dedicated ZeroDelay in the client's own cloud account in their chosen country.
• Your own cloud stays yours. After a dedicated setup goes live, we do not monitor or access the client's cloud account. The client reports any issue to us. To investigate, the client gives us fresh access credentials, and can withdraw them once the issue is fixed.
• AI region. The AI provider is chosen for each project. Where it offers processing in the client's region we use that; otherwise it runs in the provider's own region.
• People. Least-privilege access for our team, with access reviewed regularly.
• Incidents. We notify affected clients and authorities as the law requires.

Report a vulnerability: [email protected]. Please give us reasonable time to fix it before disclosing it, and do not access data that isn't yours.