[ Trust center ]

What we do, and what we don't claim.

An agency inbox holds personal details, so trust has to be earned in specifics. This page gives the honest status of every control: what is in place, what is planned, and what we do not hold.

[ Controls ]

Status, item by item.

Security controls and their status
Control	Status	What it means
Encryption in transit	In place	All traffic is HTTPS with HSTS; framing, MIME sniffing and referrer leaks are blocked by default.
Encryption at rest	In place	Data at rest is encrypted by our database provider, hosted in the United States.
Tenant isolation	In place	Every table carries the agency it belongs to and is protected by row-level security in the database itself, so isolation holds even if the app has a bug.
Personal mail never stored	In place	Clearly personal email is dropped in memory; only a count is kept. Uncertain email is shown to the owner only, as sender and subject, until the owner decides.
Role-based access	In place	Employees, approvers and owners each see what their role allows, on screen, in notifications and in reports.
Four-eyes approval	In place	Where approval is required, the person who prepared the work can never approve it.
Audit trail	In place	Assignments, approvals, sends and setting changes are logged with who and when. A database trigger blocks edits and deletes.
Accounts issued by the agency	In place	No public sign-up. Owners invite their team and can switch anyone off, which ends their sessions everywhere.
Least access to your mailbox	In place	Microsoft's official Graph API with only the permissions you grant. Revoke them any time.
SSO and multi-factor sign-in	Planned	Not available yet. Sign-in is by email and password, with an optional bot check. Microsoft sign-in and MFA are on the roadmap.
Data residency	United States	Agency data is stored in the United States. Our engineering and support team works from India and accesses it only when a task needs it.
Backup and retention	In place	Backups are taken by our database provider on its schedule. Contact requests are deleted after 24 months; agency data is deleted within 90 days of leaving. A daily job enforces both.
Incident response	In place	We tell the agency about a confirmed incident affecting its data within 48 hours, as our DPA commits, so it can meet its own notification duties.
SOC 2 report	Not started	We do not hold a SOC 2 report today and will not say otherwise.
Independent penetration test	Planned	Not yet carried out by an independent firm. We will publish the date and summary when it is done.
ISO 27001 certification	Not held	Not held today.
E&O and cyber insurance	Ask us	Ask us for the current position. We will not claim cover we do not hold.

We do not describe Shlix as “compliant” or “certified” with any standard unless an audit report exists.

[ Registrations and certifications ]

Who we are, on the record.

Shlix AI is a product of Zerobyte Technologies Private Limited, a registered Indian company. Every number below can be checked at the issuer's own site.

Company registrations and certifications
Registration	Number and scope	Validity	Check it
Registered companyMinistry of Corporate Affairs, Government of India	CIN U72900OR2022PTC040264Zerobyte Technologies Private Limited, a private company limited by shares, incorporated on 14 July 2022 under the Companies Act, 2013.	Active	mca.gov.in
GST registrationGoods and Services Tax Network, Government of India	GSTIN 21AACCZ0124H1ZWRegular registration, Odisha. Our invoices to US agencies are exports of services.	Since 6 August 2022	gst.gov.in
ISO 9001:2015Universal Certification Services Pvt. Ltd.	Certificate UCSPL8024I02663Quality management system, for providing AI and IT services. A quality standard, not a security certification.	Certified 29 October 2024, valid to 28 October 2027, subject to annual surveillance audits	universalcertification.co.in
Startup India recognitionDepartment for Promotion of Industry and Internal Trade (DPIIT), Ministry of Commerce & Industry	Certificate DIPP181383Recognised as a startup in IT Services, IT Consulting.	Issued 28 October 2024, valid to 13 July 2032	startupindia.gov.in
Udyam (MSME) registrationMinistry of Micro, Small and Medium Enterprises, Government of India	UDYAM-OD-19-0033303Micro enterprise; computer programming, software support and IT services.	Classified for 2026-27	udyamregistration.gov.in

ISO 9001:2015 certifies how Zerobyte manages quality in its AI and IT services. It is not a security certification: SOC 2 and ISO 27001 are shown above as not held.

[ Documents ]

Ask for the paperwork.

Security and legal documents
Document	What it is	Get it
Security overview	How the service is built, hosted and protected. PDF, on request.	Request it
Data Processing Addendum	The written service-provider terms for GLBA and state insurance law.	Read it
Sub-processor list	Who helps us process data, where, and which data.	Read it
Company documents	Certificate of incorporation, GST registration, ISO 9001:2015 certificate, Startup India and Udyam certificates. On request.	Request it
Insurance certificates	E&O and cyber cover, if held. On request.	Request it
Security questionnaire	Your carrier's or association's questionnaire, completed with you before you sign.	Request it

[ Who helps us ]

Sub-processors.

Sub-processors
Provider	What it does for us	Where
Supabase	Database, file storage and sign-in	United States (AWS us-east-1)
Vercel	Website and application hosting; cookieless visitor statistics on the public pages	Global edge network; application functions in the United States
Anthropic	AI model provider: reading and classifying requests, through its commercial API	United States
Resend	Sends the agency's replies and notifications by email, when the agency's mailbox cannot send them itself	United States
Groq	AI model provider used for demonstrations on sample data only	United States
Cloudflare	DNS and mail routing; Turnstile bot check on the sign-in page, when enabled	Global
Web3Forms	Delivers website contact requests to our team's inbox	As set out in the provider's terms
Calendly	The booking calendar for walkthroughs on the website	United States
Google	Calendar invitations and Google Meet for walkthroughs and support calls	United States and Google's other data center locations

The data each one handles, and how we give notice of changes, is on the sub-processor page.

[ Your data ]

What we send, and how long we keep it.

What goes to AI
Only what a task needs. An email is read up to a fixed length, with its subject and sender, and personal mail is dropped before anything is kept. See our AI use policy.
How long we keep it
Contact requests, and any documents attached to them, up to 24 months. Agency data while the agency uses Shlix; when it leaves, we return it on request and delete it within 90 days. Personal mail is never stored.
If something goes wrong
We tell the agency within 48 hours of confirming an incident, so it can meet its own notification duties. Found a vulnerability? See our disclosure process.
Your questions
A security questionnaire from your carrier or association? We complete it with you before you sign.

Read the detail

The full explanation is on our security page, in the privacy policy and the terms.

Ask a security question