> ## Documentation Index
> Fetch the complete documentation index at: https://docs.zudo.so/llms.txt
> Use this file to discover all available pages before exploring further.

# Security & data handling

> How Zudo isolates organizations, protects data in transit and at rest, how long each kind of data is kept, and where to find the trust centre, subprocessor list and vulnerability disclosure policy.

Zudo holds a lot of a customer success team's most sensitive material — email threads, meeting transcripts, support conversations, revenue figures, contracts and product telemetry. This page covers how that data is isolated, protected and aged out, and points at the canonical trust documents.

<Note>
  The authoritative statements live on the [Trust centre](https://zudo.so/trust), the [Security
  policy](https://zudo.so/security) and the [Subprocessor list](https://zudo.so/subprocessors). This page summarises
  them for readers who are in the documentation, and adds the concrete retention periods.
</Note>

## Isolation

Every record in Zudo belongs to exactly one organization, and every query is scoped to the organization of the requesting user or API key. That scoping is applied in middleware rather than per-route, so a route can't forget it.

Switching organizations changes what you can see immediately: a request for an account outside your current organization returns `404`, not a filtered-empty result, so the existence of another tenant's records isn't observable.

## Access control

| Control      | Behaviour                                                                                          |
| ------------ | -------------------------------------------------------------------------------------------------- |
| **Roles**    | Member, Admin and Owner. See [Members](/settings/members) for what each can do.                    |
| **API keys** | Scoped to one organization, revocable at any time. See [API keys](/settings/api-keys).             |
| **MCP**      | OAuth authorization code + PKCE. See [MCP](/integrations/mcp).                                     |
| **Webhooks** | Each inbound webhook has its own token and shared secret, and signatures are verified on delivery. |
| **Gmail**    | Read-only scope — Zudo never sends mail on your behalf.                                            |

## Data in transit and at rest

Traffic is encrypted in transit, and data is encrypted at rest. Integration credentials are encrypted separately from the records they unlock. The [Trust centre](https://zudo.so/trust) is the canonical statement of both.

## Retention

Different kinds of data age out on different schedules. A nightly job enforces these:

| Data                                      | Retained                                                                |
| ----------------------------------------- | ----------------------------------------------------------------------- |
| **Raw product events** (staging)          | 7 days after processing — they've already been aggregated into rollups. |
| **Product event rollups**                 | Indefinitely. These are daily counts, not payloads.                     |
| **Account health scores**                 | Daily for 90 days, then one point per week, deleted after 1 year.       |
| **Identity graph links** (user → account) | 180 days unless re-asserted by a newer event.                           |
| **Job run logs**                          | 30 days.                                                                |
| **Automation and webhook execution logs** | 30 days.                                                                |

Product events are also archived as gzipped JSONL in object storage so historic events can be replayed if you change which ones you roll up. Archive lifecycle is configured on the storage bucket rather than by the application.

<Warning>
  Those archives contain the **full payload** of every event your source sends. If your Segment or PostHog events carry
  personal or sensitive fields you don't want retained, filter them at the source — Zudo stores what it receives.
</Warning>

## Deleting and exporting

Disconnecting an integration stops the sync and revokes the stored credential. Accounts, contacts and related records can be deleted from the app, and exported through the [API](/api-reference/introduction). See the [Trust centre](https://zudo.so/trust) for how deletion requests are handled.

## Reporting a vulnerability

Report security issues through the [Security policy](https://zudo.so/security) page, which carries the current contact address and disclosure expectations. `https://zudo.so/.well-known/security.txt` is published per [RFC 9116](https://www.rfc-editor.org/rfc/rfc9116).

## Subprocessors

The third parties that process customer data on Zudo's behalf are listed at [zudo.so/subprocessors](https://zudo.so/subprocessors), which is the version to cite in a vendor review.