Your Data Deserves Real Security Controls — Not Just a Privacy Policy

Managing Zenphi's Access to Your Data

This section explains the limited circumstances under which access to customer data may be required by Zenphi personnel, the internal controls that keep that access appropriate and limited, and the settings you can use to manage and control your own stored data.

How Does Zenphi Safeguard Your Data From Unauthorized Access?

Security and data privacy was not an afterthought at Zenphi — it forms the foundation of the entire Zenphi platform and was part of it from inception. At Zenphi, we follow a secure software development life cycle (SDL). From ideation to development, testing, deployment and maintenance, security best practices are followed and enforced throughout. This ensures any new feature that we develop does not inadvertently compromise on the security and data privacy of our customer's data.

Access controls are built into Zenphi. Only authorized users for a workspace are able to access data. All users are authenticated using Google single sign-on and assigned access tokens for workspaces that they have access to. These tokens contain security permission information, which is verified by Zenphi for every action they take in the system. All actions a user takes in the system are audited and can be viewed by the workspace administrator.

Within the workspace, users can control who can view/edit items such as flows, connections, etc. This privacy setting is enforced throughout the system.

Customer Controls Over Access to Data

At Zenphi, we are firm in the belief that: you own your data, and we will never use it for any purpose other than those necessary to fulfill our contractual/legal obligations. We understand that, in addition to our commitments, customers want additional transparency and control over their data in Zenphi. That is why Zenphi offers industry-leading controls to define how and when data is purged from our system.

While a flow is executing, Zenphi requires the flow reference data and metadata for it to be able to execute the flow to completion. When the flow completes, either successfully or in an erroneous state, this information is no longer required and can be purged. Customers can define how data is purged using the data handling global setting or override it on a per-flow basis — automatically upon completion, or on a schedule (e.g. 14 days after the flow has completed). There are 3 levels that customers can configure:

With these options, customers have granular control over their data stored in Zenphi. For example, a customer could configure Level 2 when a flow completes successfully and Level 1 when it errors, plus a schedule on Level 3 to purge all information after 30 days regardless of flow state. If the flow succeeds, reference data is purged immediately; if it errors, the team can troubleshoot and rectify it before the 30-day schedule purges everything.

Access Authorizations for Zenphi Employees

All Zenphi employees undergo background checks, are required to execute a confidentiality agreement, and comply with Zenphi internal policies. The number of employees that may have access to customer data is limited, and systems are in place to actively monitor and log the activities of those employees.

Zenphi employees are only granted a limited set of default permissions to access company resources. Access to internal support tools is controlled via Access Control Lists (ACLs). A formal process is followed at Zenphi to grant or revoke employee access to Zenphi resources, and access is automatically removed for departing employees.

Access authorization is enforced at all relevant layers of the system and infrastructure. When a support engineer needs access to customer data for diagnostics, an approval workflow is triggered in Zenphi and required minimum privileges are granted on an as-needed basis. An employee's authorization settings are used to control access to all resources, including data and systems of the Zenphi platform.

Our Commitment to You

Protecting customer data is a primary design consideration for the Zenphi platform. Our security practices are verified by independent third parties, providing assurances to customers regarding our security controls and practices. In line with our view that customers own their data, we offer advanced options for customers to control how their data is managed in the platform.

Security is an ongoing commitment at Zenphi, and we will ensure our customers can use our platform in a secure and transparent manner.