Trust & security
Your sponsor data, looked after
Zephlo holds commercial relationships worth real money to you. Here's how that data is kept safe. Plain terms, no jargon.
One organisation can never see another's
Every organisation's data lives in its own space, enforced at the database itself with row-level security, not just hidden in the interface. There's no query that returns another organisation's sponsors.
Encrypted in transit and at rest
Traffic is served over HTTPS, and data is encrypted where it's stored. Nothing about your sponsors travels or sits in the clear.
Hosted in the EU
Your data is stored on infrastructure in the European Union: database in Ireland, application in Dublin. The one exception is the AI features: when you use them, the relevant text is processed by Anthropic in the US under standard contractual clauses, never stored there and never used for training. Organisations that need zero non-EU processing can switch the AI off.
Backups we've actually tested
We take database backups. We have also run a full restore drill, the part most vendors skip, rebuilding the database from scratch to prove the data genuinely comes back. We'll tell you plainly where our recovery times stand rather than hide behind the word 'backed up'.
Audited for the common attacks
The codebase has been through a full SQL-injection audit with zero findings, and access to every route is checked against who you are and which organisation you belong to.
The AI is on a short leash
AI features only read the data you've logged, run behind strict usage limits, and never train anyone's models on your information.
Who else touches your data
Zephlo runs on a small set of well-known services. Each one only sees what its job requires:
- SupabaseDatabase, authentication and file storage. EU region.
- VercelHosts the application and serves it over HTTPS.
- AnthropicProcesses text for the AI features. Does not train models on your data.
- Make.comDelivers notification and confirmation emails.
- CalendlyCall booking. Only used if you book a call with us.
- Cloudflare TurnstileBot protection on forms. Sees the request, not your data.
That's the whole list. If it changes, this page changes.
Questions from your IT team or a security questionnaire? Ask when you request access and we'll answer them straight. Read the privacy policy.