Security and privacy · Zapstro Help Center

Roles and permissions

Each person needs their own account. Shared logins make it impossible to know who did what.

Admin: broad management access. Give it only to the people responsible for setup and security.
Agent role: operational access you can fine-tune in Settings › Users, in each user's permissions:
- Pages and actions: which modules they see, and sensitive actions such as deleting, importing or exporting contacts.
- Working hours: when they can operate.
- Connections: which numbers and channels they can use.
- Sectors and conversation visibility: which queues and conversations they see.

Passwords must have 8 to 128 characters with an uppercase letter, a lowercase letter, a number and a symbol.

Two-factor authentication

Zapstro offers two-factor authentication options. Turn it on for your account when it's available, especially for Admins. Keep your credentials confidential.

Audit log

Audit (in Settings) records who did what and when: logins and failed logins, password changes, creations, edits, deletions, imports, exports, transfers, stage changes, connections and automations. Each entry shows the user (or System for automatic actions), date and time, IP address and the item affected.

Filter by period, user, action and item type. Each page shows up to 100 events.
The log is read-only: it can't be edited.
Restrict access to Admins.

Example: "Was there suspicious access?" Filter by login and failed login, pick the user and compare times and IPs with their normal routine.

How we protect data

Connections are encrypted in transit, access is role-based, every API call is logged and AI tools only do what you allow. There are backups and restricted staff access. No system is 100% secure; if a breach affects personal data, we notify you and the authorities as the law requires.

You own your customer data and are its controller; Zapstro acts as your processor.
A data processing agreement (DPA) is available on request: email contact@zapstro.com.
You're responsible for having a legal basis and the consent needed to message your contacts.
AI features use the provider selected for your account (currently OpenAI, Google Gemini or Anthropic Claude), under business terms that don't allow using your data to train their models.
Transfers outside the EU/UK use safeguards such as the EU Standard Contractual Clauses.
Data rights requests: contact@zapstro.com. We answer within 30 days.

Read the full Privacy Policy and Terms of Use.