Trust

Privacy & Security

Last updated: October 15, 2026

This page explains how ZRSpro LLC (“ZRSpro,” “we,” “us”) protects information processed through SAVI, including SAVIcrm, SAVIcam, SAVIdata, AI features, and related services (the “Services”); what we are responsible for; what you are responsible for; and the data-processing terms that apply when we handle personal information on your behalf. It forms part of, and should be read with, the Terms & Conditions, Privacy Policy, and Acceptable Use Policy. Capitalized terms not defined here have the meanings given in the Terms.

1. Our approach to security

We use a layered set of administrative, technical, and organizational safeguards designed to protect the confidentiality, integrity, and availability of information in the Services. We build on enterprise-grade cloud infrastructure and established third-party technology providers, select vendors with mature security programs, limit internal access to what is needed, and review our practices as the Services and threats evolve.

2. Shared responsibility model

Security outcomes depend on both parties. The table below summarizes the general division of responsibility. Where this table and the Terms conflict, the Terms control.

3. Infrastructure security

• Hosting. The Services run on enterprise-grade cloud infrastructure operated by established third-party providers that maintain independent security audits and certifications (such as SOC 2 Type II reports).
• Encryption in transit. Data sent between your browser or device and the Services is encrypted using industry-standard TLS.
• Encryption at rest. Stored data is encrypted at rest using industry-standard encryption (such as AES-256) within our providers’ infrastructure.
• Network protection. Our infrastructure providers employ protections such as firewalls, web application firewalls, and distributed denial-of-service (DDoS) mitigation.
• Physical security. Data centers are operated by our infrastructure providers, which maintain physical and environmental controls. ZRSpro does not operate its own data centers.

4. Product security features

• Two-factor authentication (2FA) for user logins. We may require 2FA for some or all accounts.
• Role-based permissions so you can control what each user can see and do.
• Activity and audit logging for certain account events, where available.
• Single sign-on (SSO) and additional login controls, where available on your plan.
• Consent and data-request tools to help you record consent, process opt-outs, and handle access and deletion requests from your End Clients.

Feature availability may vary by plan and may change over time. You are responsible for configuring and using these features appropriately.

5. Operational security

• Least-privilege access. ZRSpro personnel access Customer Data only when needed to provide, support, secure, or improve the Services, to provide services you request (such as admin support, onboarding, or data migration), or as required by law.
• Confidentiality. Personnel and contractors with access to Customer Data are bound by confidentiality obligations.
• Training. Personnel receive guidance on security and privacy practices appropriate to their role.
• Vendor management. We evaluate the security posture of key vendors and require them to protect information they process for us.
• Admin support access. When you engage ZRSpro for administrative support, coaching, onboarding, or setup services, you authorize the personnel performing those services to access your account and data as needed to perform them. You may revoke that access at any time by removing the relevant user or contacting us.

6. Application security

• Our underlying platform providers perform regular vulnerability scanning and independent penetration testing.
• Changes to the Services are reviewed and tested before release.
• We monitor for misuse, abuse, and suspicious activity, and we may suspend activity that appears to threaten the Services or other users.
• Unauthorized security testing, scanning, or penetration testing of the Services is prohibited (see the Acceptable Use Policy). We do not operate a paid bug bounty program.

7. Availability, backups, and business continuity

Our infrastructure providers maintain redundancy, backup, and recovery capabilities designed to support availability of the Services. However, we do not guarantee uninterrupted availability, any particular uptime, or recovery of any specific data, and the Services are not a backup service. You are responsible for regularly exporting and independently backing up your Customer Data, as described in the Terms. Planned maintenance, carrier or provider outages, and events beyond our reasonable control may affect availability.

8. Incident response and breach notification

• We maintain procedures to identify, investigate, contain, and remediate security incidents.
• If we become aware of a confirmed security breach that results in unauthorized access to or disclosure of Customer Data in our systems (a “Security Incident”), we will notify the affected Subscriber without undue delay after confirming it, and we will provide information reasonably available to us to help you meet your own obligations.
• Unless the law requires otherwise, you are responsible for determining whether and how to notify your End Clients, regulators, or others, and for the content, timing, and cost of those notifications.
• Our notification of a Security Incident is not an admission of fault or liability.
• Incidents caused by your credentials, users, devices, integrations, or configuration are your responsibility, and we may charge for assistance with them.

9. Privacy law compliance

We design the Services to support compliance with privacy and communications laws, including the GDPR and UK GDPR, the California Consumer Privacy Act and other U.S. state privacy laws, CAN-SPAM, and the TCPA. Using the Services does not by itself make your business compliant with any law. You remain solely responsible for your own compliance, including your privacy notices, consent practices, data-request handling, messaging practices, and record keeping.

10. Health information (HIPAA)

The Services are not designed for, and you must not use them to store or transmit, protected health information (“PHI”) as defined under HIPAA, unless ZRSpro has first signed a separate written Business Associate Agreement (“BAA”) with you for a plan that supports it. Without a signed BAA, you are solely responsible for any PHI you place in the Services, and you will indemnify ZRSpro for any resulting claims.

11. Payment card data

Payment card information is collected and processed by our third-party payment processors, which are responsible for their PCI DSS compliance. You must not store full payment card numbers, security codes, or similar sensitive financial data in notes, custom fields, messages, or files within the Services.

12. AI and your data

• We do not use your Customer Data or End Client information to train generalized, publicly available AI models.
• AI providers we use are limited to processing information to deliver the requested feature.
• You should not enter sensitive personal information, PHI, payment card data, or highly confidential information into AI features unless that use is permitted by your plan and the law.
• AI use is governed by the Acceptable Use Policy and the Terms.

13. Subprocessors

We use third-party subprocessors to provide the Services. Categories include:

• Cloud hosting, platform, and infrastructure providers
• Telecommunications, SMS, voice, and email delivery providers and carriers
• Payment processors
• AI and machine-learning service providers
• Data, enrichment, and verification providers (including for SAVIdata)
• Analytics, logging, monitoring, and customer-support tools

Current subprocessor information is available on request to the contact below. We may add or replace subprocessors at any time; where required by law or agreed in writing, we will provide notice of material changes.

14. Data Processing Addendum

This Data Processing Addendum (“DPA”) applies when ZRSpro processes personal data contained in Customer Data on your behalf as your processor or service provider. It is incorporated into the Terms and applies automatically; no separate signature is required. If you require a countersigned copy, contact us.

14.1 Roles

You are the controller (or “business”) of personal data in Customer Data, and ZRSpro is your processor (or “service provider”/“contractor”). Where you act as a processor for your own clients, ZRSpro acts as your subprocessor, and you are responsible for obtaining any authorizations required from your clients. ZRSpro is a controller of Subscriber account, billing, and usage information as described in the Privacy Policy.

14.2 Instructions

We process personal data only on your documented instructions, which consist of the Terms, your configuration and use of the Services, and any other written instructions we agree to. We will inform you if we believe an instruction violates applicable data-protection law, and we may decline to follow it. You are responsible for ensuring your instructions are lawful.

14.3 Service-provider commitments

Where U.S. state privacy laws apply, we will not sell or share personal data in Customer Data; retain, use, or disclose it outside our direct business relationship with you or for any purpose other than providing the Services; or combine it with personal data from other sources except as permitted by law.

14.4 Confidentiality and security

We ensure that persons authorized to process personal data are bound by confidentiality obligations, and we implement the measures described on this page. You agree these measures are appropriate for the risks involved.

14.5 Subprocessors

You give us general authorization to engage subprocessors, including those described in Section 13. We impose data-protection obligations on subprocessors that are no less protective in substance than this DPA, as appropriate to the services they provide, and remain responsible for their performance as required by law.

14.6 Assistance with requests

Taking into account the nature of the processing, we will provide reasonable assistance, primarily through the tools available in the Services, to help you respond to requests from individuals exercising their data-protection rights. If we receive such a request directly, we will redirect the individual to you where permitted. We may charge reasonable fees for assistance beyond the self-service tools.

14.7 Security Incidents

We will notify you of Security Incidents as described in Section 8.

14.8 Impact assessments

We will provide reasonable information to help you complete data-protection impact assessments or consult with regulators where required by law and to the extent you cannot obtain the information yourself.

14.9 Deletion and return

During your subscription you may export Customer Data using the tools available in the Services. After termination, we will delete or anonymize Customer Data within a commercially reasonable period in accordance with the Terms, except where retention is required by law or the data remains in backups that are overwritten in the ordinary course. It is your responsibility to export your data before termination.

14.10 Audits

On written request no more than once per year, we will provide information reasonably necessary to demonstrate compliance with this DPA, which may include summaries of third-party audit reports from our infrastructure providers, subject to confidentiality. On-site audits are permitted only where required by law, at your expense, on reasonable advance notice, during business hours, and in a manner that does not compromise the security or confidentiality of other customers.

14.11 International transfers

Personal data may be processed in the United States and other countries where we or our subprocessors operate. Where data-protection law requires a transfer mechanism, the parties agree to rely on an appropriate mechanism, such as the applicable Standard Contractual Clauses, which are incorporated by reference to the extent required.

14.12 Liability and precedence

Each party’s liability under this DPA is subject to the limitations and exclusions of liability in the Terms. If this DPA conflicts with the Terms regarding the processing of personal data, this DPA controls only to the extent of the conflict.

15. Government and law-enforcement requests

We review requests for data from governments and law enforcement carefully, and we may require valid legal process. We may reject, challenge, or seek to narrow requests that appear unlawful, overbroad, or improperly served. Where legally permitted, we may notify the affected Subscriber and direct the requester to the Subscriber. Nothing limits our ability to respond to emergencies, preserve or disclose information, or cooperate with authorities where permitted or required by law. See the Terms for legal-process requirements.

16. Responsible disclosure

If you believe you have found a security vulnerability in the Services, report it to [email protected] with “Security” in the subject line and enough detail for us to reproduce it. Please do not access, modify, or delete data that does not belong to you, disrupt the Services, or publicly disclose the issue before we have had a reasonable opportunity to address it. Reporting does not authorize testing that violates the Acceptable Use Policy, and no reward is promised.

17. Security questionnaires

Subscribers may request reasonable security information for their own vendor-review processes. We may provide summary information, completed standard questionnaires, or infrastructure-provider documentation at our discretion and subject to confidentiality.

18. Changes to this page

We may update our security practices and this page from time to time, provided that changes do not materially reduce the overall protection of Customer Data. Updates take effect when posted.

19. Contact