Guide · Security and privacy
Security and privacy
Where we store your data, who sees it inside your workspace, how we protect sensitive fields and how you turn on two-step verification for your account.
This guide sums up how we look after your data and the data of the people who fill in your Intake Bots. The full commitments are in our data processing agreement and on our security page.
Where your data lives
We store your data in the United States. Every connection to ioZen goes over HTTPS.
Each workspace is isolated from the others: people in another workspace see nothing of yours, and each API key gives access to one workspace only.
If a breach affects your data, we notify you within 48 hours of becoming aware of it.
When your access ends, you have 30 days to export your data. If you delete a workspace, the owner has 30 days to restore it before it's gone for good.
Who sees what in your workspace
Everyone on your team has a role: “Owner”, “Admin” or “Member”. The owner and admins handle integrations, webhooks and API keys. Only the owner can delete or restore the workspace. How to add people and set their role is in Invite your team.
Private and encrypted fields
On the Business plan, you can protect your Intake Bot's sensitive questions, like an ID number at a clinic or property details at a real estate office.
Open the question in your Intake Bot's editor and turn on “Privacy Protection”. The answer is stored apart from the others, and AI never reads it. For one more layer, turn on “Encrypt at Rest”: the answer is encrypted at rest.
A question with branches, or with AI turned on, can't be private: ioZen needs to read its answer to keep the conversation going.
Every time someone on your team opens a private answer, we log who opened it and when.
Keys and credentials
Two-step verification
ioZen offers two-step verification with an authenticator app, optional for customers and required for ioZen staff.
To turn it on, tap your name at the bottom of the sidebar and choose “Account”. Go to “Security” and tap “Add authenticator app”. Scan the QR code with your app and enter the code it shows. From then on, every time you sign in we ask for a code from that app.
Certifications and testing
SOC 2: not yet. We started a penetration test with an outside firm.
Get in touch
For security questions or to report a vulnerability, write to us at hello@iozen.ai.
Frequently asked questions
- Where is my data stored?
- In the United States.
- Does ioZen have SOC 2?
- Not yet. We started a penetration test with an outside firm.
- Does AI read private fields?
- No. A private field is stored apart from the other answers, and AI never reads it.
- How do I report a security issue?
- Write to us at hello@iozen.ai.