Security

In every app

• Your business’s data is kept apart from every other business’s. The Zinvee account and Inbox enforce this in the database itself, with Postgres row-level security; CRM and Work limit every query to your business.
• People see what their role allows. Each app has roles, from owner or admin down to a caller, an agent or a guest.
• Passwords are never stored. Where an app uses them, only a slow, salted hash is kept: Argon2id for the Zinvee account, bcrypt in CRM and Inbox. Work has no passwords at all.
• Sign-in attempts are rate limited, so guessing a password or a code is slow.
• API keys are shown once, stored only as a hash so nobody can read them back, limited to what they were given, and can be revoked at any time.
• Messages from Meta are checked. WhatsApp, Instagram and lead-ad messages are accepted only with a valid signature from Meta.
• Everything travels over HTTPS.

Payments

When you pay by card or UPI, you pay in Razorpay’s checkout, so those details never reach our servers. Messages from Razorpay are checked against Razorpay’s signature before they change your plan.

Your Zinvee account

• Sign in with a code sent to your email or WhatsApp, or with a password.
• Turn on two-step sign-in with an authenticator app, with recovery codes. Turning it on signs out your other sessions.
• See where you are signed in, end any session, or sign out everywhere else. Changing your password ends your other sessions.
• Stored secrets, such as two-step sign-in keys, are encrypted with AES-256-GCM.
• Our own operators must use two-step sign-in, and every change they make is recorded.

Zinvee CRM

• A telecaller can be signed in on one device at a time; admins and managers on one browser and one phone. Changing or resetting a password signs out every device.
• Telecallers see only their own leads, and managers only their own campaigns and team.
• Admins and managers can read the activity trail of who changed what.
• Deleted leads and enquiries wait in a recycle bin for 30 days before they are removed.
• The database is backed up every two hours, and copies are kept for 14 days on the server and 30 days off-site.
• API keys can only read, each with its own scopes and limits, and admins are told when a key uses 80% of its daily budget.

Zinvee Inbox

• Roles (owner, admin, agent, viewer) and whether someone is switched on are checked on every request, so a change applies at once. Changing a password ends sessions signed in with the old one.
• Webhooks to your systems are signed with HMAC-SHA256, and go only to HTTPS addresses on the public internet.
• API keys carry only the scopes you tick, from reading contacts to sending messages.

Zinvee Work

• Sign in with a one-time code by email. There are no passwords, and a code allows five tries.
• Two-step sign-in with an authenticator app and recovery codes, and an admin can require it for the whole workspace.
• An admin can make new devices wait for approval, and limit sign-in to chosen countries. Anyone can sign out everywhere.
• Files open through links that expire within 15 minutes.
• Credentials for connected services are encrypted with AES-256-GCM.
• Webhooks are signed with HMAC-SHA256, and requests to addresses you give go only to the public internet, never inside our network.
• Admins can export the whole workspace, and delete it themselves. A deleted workspace is held for 30 days, then removed, apart from the payment and invoice records the law requires us to keep.

Found a problem?

If you think you have found a security problem in any Zinvee app, write to [email protected] with what you found and how to see it. Please give us time to fix it before telling anyone else. For anything else, see Contact.