Skip to main content
Zudo holds a lot of a customer success team’s most sensitive material — email threads, meeting transcripts, support conversations, revenue figures, contracts and product telemetry. This page covers how that data is isolated, protected and aged out, and points at the canonical trust documents.
The authoritative statements live on the Trust centre, the Security policy and the Subprocessor list. This page summarises them for readers who are in the documentation, and adds the concrete retention periods.

Isolation

Every record in Zudo belongs to exactly one organization, and every query is scoped to the organization of the requesting user or API key. The scoping clauses are built once, in shared middleware, and every route builds its queries from them. Switching organizations changes what you can see immediately: a request for an account outside your current organization returns 404, not a filtered-empty result, so the existence of another tenant’s records isn’t observable.

Access control

Data in transit and at rest

Traffic is encrypted in transit, and data is encrypted at rest. Integration credentials are encrypted separately from the records they unlock. The Trust centre is the canonical statement of both.

Retention

Different kinds of data age out on different schedules. A nightly job enforces these: Product events are also archived as gzipped JSONL in object storage so historic events can be replayed if you change which ones you roll up. Archive lifecycle is configured on the storage bucket rather than by the application.
Those archives contain the full payload of every event your source sends. If your Segment or PostHog events carry personal or sensitive fields you don’t want retained, filter them at the source — Zudo stores what it receives.

Deleting and exporting

Disconnecting an integration stops the sync and revokes the stored credential. Accounts, contacts and related records can be deleted from the app, and exported through the API. See the Trust centre for how deletion requests are handled. When a person asks to be deleted, their name, email, profile, sign-in and API keys are removed, along with their own saved views, charts and dashboards, and the stored credentials of any mailbox or meeting recorder they connected. What they did inside an organization stays with that organization, credited to “Former member”: notes, tasks they created, requests they own and meetings they recorded. They are removed from every organization first, and their accounts, tasks and flags go back to that organization’s CSM assignment rules.

Reporting a vulnerability

Report security issues through the Security policy page, which carries the current contact address and disclosure expectations. https://zudo.so/.well-known/security.txt is published per RFC 9116.

Subprocessors

The third parties that process customer data on Zudo’s behalf are listed at zudo.so/subprocessors, which is the version to cite in a vendor review.