Security
Your data and your brains, under your control
A brain works with sensitive information about your company and your customers. This is how we protect it, and how you decide what each brain can do.
Your data
Isolated by company and by brain
Each brain keeps its memory and documents in its own storage. No other customer, and no other brain in your company you haven't assigned them to, can read them.
Encrypted
Every connection uses HTTPS with TLS. Connected-account permissions and your model keys are encrypted with AES-256-GCM, bound to each brain; databases and backups are also encrypted at rest.
Never used for training
We don't sell your data or use it for advertising or to train AI models. You can bring your own Anthropic, OpenAI or Google key.
Least privilege
We ask for the narrowest permissions possible: the brain can send email but not read your mailbox, and in Google Drive it only sees the files it creates or the folders you assign.
Your brains
Autonomy per action
For each action you decide whether the brain does it on its own, leaves it as a draft for a person to approve, or never does it. You also set hours, days and daily limits.
Prompt-injection defense
What comes from outside (emails, messages, documents) is treated as data, never as orders. If a message tries to make the brain write to a third party or change how it works, the action goes to approval. Automated tests check this on every change.
A log of every action
What each brain did, when, with what judgment and who approved it. What people do in the portals is kept in an audit log.
Your team
Sign-in with two-step verification
The Console asks for a password and a code from an authenticator app. Accounts are locked after repeated attempts.
Roles
Administrator, approver, reader or billing: each person sees and does only what their role allows.
The Zunous team
Our internal dashboard is protected by Cloudflare Access, and we only access a company's data for support it requests, for security or when the law requires it.
Continuity
Tested backups
Daily backups of the whole platform, with fingerprints to prove they don't change, and a test restore every four weeks.
Monitoring and a public status page
We check the service every few minutes and publish its availability on the status page.
Incident plan
A response plan that includes notifying affected companies and authorities when the law requires it.
Leave with your data
You can ask for a full export of your information and for your company to be fully deleted, with a certificate of deletion.
Does your security team need more detail? Write to us at hello@experientia.pro.