Trust & Security
Last updated: 31 October 2026
Zandolie is built to sell on your behalf, so it has to be trustworthy with your prices, your stock and your customers. Here's how we approach that today, and what we're working towards.
Prices and stock come from your systems
The agent never invents prices, stock levels, discounts or totals. Commercial values come from your connected systems (for example Zoho Inventory) and are checked by our servers before a customer sees them. If your system can't be reached, the agent says so and hands over rather than guessing.
You stay in charge
Your team can take over any conversation at any time, and the agent stops replying while a person is handling it. The agent hands off to your team when a customer needs something it shouldn't decide alone.
Your data stays yours
Each business's data is kept separate from every other business's. Our staff only open a customer conversation when you've raised a support request and given permission. A support-access log your admins can see is coming soon.
We use the official WhatsApp Business Platform (Cloud API) from Meta, never unofficial WhatsApp tools.
Account security
- Roles: when teams are set up, agents see only their own team's conversations; admins see all teams in their business.
- Passwords: at least 12 characters, set by each person through a one-time emailed link. We never see or send passwords.
- Repeated failed sign-ins are temporarily blocked.
- Sessions end after 12 hours without activity, and after 7 days at most.
- Every action your staff take on a conversation (assign, transfer, notes, files viewed or downloaded) is recorded in an audit log.
- Two-step login with an authenticator app (coming soon)
Who we work with
These services process data so that Zandolie can run:
- Meta (WhatsApp Business Platform)
- Anthropic: AI model provider, for AI Agent workspaces only. Team Inbox workspaces have no AI and their conversations aren't sent to Anthropic.
- Zoho: when you connect Zoho Inventory
- Hostinger: hosting for the Zandolie platform
- Resend: sends account emails (sign-in links and alerts to your team)
- Cloudflare: stores photos, voice notes, videos and documents shared in conversations (encrypted per business) and our encrypted backups
- Sentry: error monitoring, with personal data removed before it's sent
- HostGator: hosts this website and our enquiry form
Our privacy policy explains how personal data is handled.
What we're working towards
We're preparing Cloud Security Alliance STAR Level 1 and STAR for AI Level 1 self-assessments, which set out our security and AI governance controls in a standard, published format. They haven't been submitted yet; we'll update this page when they are. Independent security testing will follow once the platform's public surface is stable.
Report a vulnerability
If you think you've found a security issue, email security@zandolie.ai with the details and steps to reproduce. Please give us a reasonable chance to fix it before sharing it publicly. We'll acknowledge your report and keep you updated.
Our security contact details are also published in security.txt.
Support
For help with your account, email support@zandolie.ai.
Get Zandolie working on your own products
Tell us about your business and we'll get back to you within one business day to set Zandolie up on your own catalogue.