In plain language
A quick orientation. The numbered sections below are the binding text.
- Zoft is ISO, GDPR and HIPAA certified. SOC 2 is in process.
- Clinics and other health-data customers can request a Business Associate Agreement (BAA). Anyone who needs a countersigned DPA can request one. Write to privacy@zoft.ai.
- Zoft does not build or train its own AI models, and never uses your data to train any model.
- Report a vulnerability to security@zoft.ai. We acknowledge within two business days.
1. Certifications and compliance
| Framework | Status |
|---|---|
| ISO | Certified |
| GDPR | Certified |
| HIPAA | Certified. A Business Associate Agreement (BAA) is available on request |
| SOC 2 | In process |
Certificates, scope and audit details are shared under NDA on request to privacy@zoft.ai. Zoft.AI Private Limited handles personal data in line with India's Digital Personal Data Protection Act, 2023, PIPEDA and Quebec Law 25 in Canada, and US state privacy laws, as described in the Privacy Policy.
2. Health data and the BAA
Do not send protected health information (PHI) through Zoft until we have signed a BAA with you. We sign one on request. Write to privacy@zoft.ai with your organisation name and the use case, and we will send the agreement.
3. How your data is handled
- You own your content and the outputs your agents produce. We use them only to run the service for you.
- Zoft does not build or train its own AI models. We use model providers through their business APIs, on terms under which your content is not used to train their models.
- TLS 1.2+ in transit. Databases, object storage and backups are encrypted at rest. Connected-app credentials are additionally encrypted at the application layer.
- Role-based access, per-workspace isolation, two-factor-protected staff access, and logged production access.
- Production data is hosted on Amazon Web Services in the United States. See the Privacy Policy for retention periods and transfers.
4. Controls over what agents do
Permissions on every tool, human-approval gates, run records and evaluations let you see and limit what an agent may do before it goes live. For Bots, see Bot safety.
5. Documents
- Data Processing Addendum. Applies when your agents process other people's personal data.
- Sub-processor list. Subscribe to change notices by emailing privacy@zoft.ai.
- Terms of Service and Acceptable Use Policy.
6. Security reports, incidents and authorities
- Vulnerabilities. Write to security@zoft.ai. We acknowledge within two business days and will not pursue good-faith researchers who respect user privacy and give us reasonable time to fix.
- Incidents. If a personal-data breach occurs we notify affected customers without undue delay and within 48 hours of confirming it.
- Government requests. We review each request, disclose the minimum, and notify the affected customer unless the law prohibits it.
7. Contacts
- Privacy, legal, BAA and DPA requests
- privacy@zoft.ai
- Security reports
- security@zoft.ai
- Support and abuse reports
- support@zoft.ai