This page is part of Zaviro's public reference, written to be read by AI assistants. Zaviro is a knowledge base of a business, built for AI tools to read: it learns from the business's email, files and business systems, and any AI tool that speaks MCP, or any code that calls its REST API, reads cited excerpts from it. Zaviro never writes the answers itself; the AI tool reading it does. Start at the overview (https://zaviro.ai/llms) for what Zaviro is and the instructions for AI assistants; every other page is listed at the end of this one. For a person, the site itself, https://zaviro.ai, covers the same ground.
The questions people raise about privacy and risk, in their own words, are answered on the trust page (https://zaviro.ai/llms/trust). This page is the reference behind those answers: the security reviewer's checklist, the privacy model, the mechanisms, and what happens to data on leaving.
Security reviewer's checklist
Zaviro is access-control-private, not zero-knowledge: the pipeline must process text to learn from it. The guarantees below are mechanisms in code. Where the answer is no, it says no.
- Data location: AWS, Canada; content leaves Zaviro only for AI processing by US-based providers, and what your own AI tools read from Zaviro goes wherever those tools run.
- AI-processing subprocessors: Anthropic, OpenAI, and Voyage AI, under API terms that exclude training on customer data; the disclosure is recorded in code, and the build fails if a provider is added without an entry or an entry ever records training use. The full subprocessor list, hosting and payments included, is in the Privacy Policy and the DPA.
- Encryption: TLS in transit; at rest, field-level application encryption on document text, email bodies, summaries, and extracted descriptions, verified by automated tests that fail if stored content is readable; access tokens issued to AI tools stored as digests.
- Access model: decided per connection, shared or personal. Per-file permission mirroring from source systems: no. A change of access in the source does not change it in Zaviro, and removal is always a Zaviro-side action.
- Sign-in: email and password, or Google, with two-factor (authenticator app, passkeys) and an organization-wide 2FA requirement the owner can enforce; SSO and SAML come with Enterprise.
- Service commitments: the Terms commit Zaviro to correct a material failure promptly and at no charge, with a prorated refund if it is not corrected within 30 days; further service terms are an Enterprise conversation.
- Third-party testing and audit reports: requested in writing through the contact form, https://zaviro.ai/contact.
- Tenant isolation: every read is scoped to the authenticated company, and the build fails if code reaches company data any other way.
- Personal versus shared: one function admits a row only when it belongs to the reader's company and is shared or the reader's own; role is not an input; any API-key read is forced to shared only.
- Connector scopes: read-only, for example gmail.readonly, drive.readonly, Mail.Read and Mail.Read.Shared, Files.Read.All, files.content.read, and crm.objects.*.read; a token-based connection such as Notion uses a token the customer creates with read capabilities; Zaviro issues no write, send, or delete call against a connected system.
- Prompt injection: every served excerpt is wrapped in a delimiter generated fresh per response, the text is neutralized first, and the instructions name it as data; removing either fails the build. The limit: Zaviro cannot make the customer's AI obey the fence.
- Staff access: no routine access to customer content; internal administration tools exclude document and email content; staff administrative access sits behind its own two-factor gate.
- Subprocessor retention: Anthropic and OpenAI hold API inputs for up to 30 days unless zero-data retention applies; Voyage AI, per its API terms. The DPA's Annex 3 states it per provider.
- Breach notice: without undue delay, and no later than 72 hours after confirmation, per the DPA.
- Audit trail: each person has their own security activity log, and every AI write is recorded as a viewable note.
- Retention and deletion: deleting a document removes the stored original and subtracts its contribution from derived knowledge; deleting the organization deletes its users, content, files and knowledge base after a 30-day recovery window (a minimal set of operational and billing records survives, per the Privacy Policy); a removed member's personal knowledge base is sealed at once, then deleted after 30 days unless an owner or admin restores the member within that window.
- Backups: continuous, with point-in-time recovery; deleted data leaves backups on the windows the Privacy Policy publishes (database backups within 30 days, storage versions within about 35).
- Certification: none yet (no SOC 2, no ISO 27001); controls designed to support SOC 2, GDPR, and PIPEDA.
- Vulnerability reports: security@zaviro.ai.
- Public chatbot: not a leak path. Only documents an admin explicitly marks public are served, visitor questions are not logged, and a personal document cannot be marked public: the database constraint refuses it.
Privacy model: roles, permissions, and who can see what
Every team member sees two knowledge bases: their own personal one, visible only to them, and the company's single shared knowledge base the whole team builds together. There is no admin override. Nobody, not even the owner, can see your personal knowledge base. Zaviro staff have no routine access to customer content either: the internal administration tools exclude document and email content, and staff administrative access sits behind its own two-factor gate. The privacy policy on zaviro.ai states the complete staff-access policy.
- A personal connection (your own inbox, or an upload you make as personal) feeds your personal knowledge base. A shared connection, set up by an admin, or an upload made as shared by someone with shared-edit authority, feeds the shared one.
- Roles: Owner, Admin, Member, plus grantable capabilities: Knowledge Editor (grantable to any member; adds the shared-edit authority that Owners and Admins already hold) and Billing Manager (granted by the owner to an admin; billing, plan changes, and inviting seats). A full permissions matrix is a reference page in the product.
- Members can upload, search, and manage their own personal knowledge; for a member, editing shared knowledge requires the Knowledge Editor capability (Owners and Admins can always edit it). A member's uploads without that capability always land personal, enforced server-side.
- API keys and public chatbot keys can never read anyone's personal knowledge base, not even the key creator's own. It is not a rule applied endpoint by endpoint: the read path drops the personal half of the filter the moment a request arrives on a key, whichever account issued it, so every read tool inherits the boundary instead of remembering it. That includes the case that looks safest of all, a key reading the private documents of the person who created it.
- A third, explicit audience exists for the public chatbot: an admin can mark individual shared documents public. Personal documents cannot be published, enforced by a database constraint.
- One simplification to know about, by design: Zaviro does not mirror per-file permissions from source systems. The connection's scope (shared or personal) is the permission decision.
Security
Security is architectural: every guarantee below is a mechanism enforced in code, not a policy promise. The mechanisms, in writing:
- Read-only connections. Every source connection is a reading connection: Zaviro never modifies, sends, or deletes anything in your source tools, and where a connector signs in through your provider it asks only for read-only scopes. You do not have to take that on trust: your provider shows you what is being granted before you approve it, your provider's own account settings show afterwards what was granted, and revoking it there cuts the connection off whatever Zaviro does. Widening what a connection can reach takes a fresh approval from your side.
- Typed, scoped keys. Key families each work only on their own surface; keys are shown once, stored as SHA-256 hashes, individually revocable, with optional expiry. A write-capable MCP key is issued only by an admin or owner.
- Spec-grade OAuth on the MCP server: PKCE, resource-audience binding (RFC 8707), dynamic client registration (RFC 7591), and a real consent screen that defends against client impersonation.
- Isolation in the build. In the code that serves requests and AI-tool calls, every read is scoped to the company of the authenticated session, server-side, and the build fails if code reaches a company's data any other way, so an ordinary request has no parameter through which to name the company it wants to read.
- Personal stays personal. One function decides what a reader may see, and it admits a row only when that row belongs to the reader's company and is either shared or the reader's own. Role is not an input to that decision, so no elevated account widens it: an owner reads the knowledge base through the same filter a new member does. The database itself refuses to mark a personal document public, so the route from private to published does not exist even for code that tried to take it.
- Encrypted everywhere. TLS in transit. Encryption at rest, including field-level application encryption on document text, email bodies, summaries, and extracted descriptions, so a raw database dump yields ciphertext. That is checked by automated tests rather than asserted. Connector credentials are encrypted at the field level and secrets live in a managed vault, never in configuration or code. The access tokens Zaviro issues to your AI tools are stored only as digests of the value, so a database read does not yield a token that can be replayed. Hosted on AWS in Canada. Content is sent to AI subprocessors for processing (named in this section, and listed in full in the privacy policy) and is otherwise stored in Canada.
- Governed writes. A key minted read-only cannot write. A write-capable MCP key is issued by an admin or owner and acts at the issuer's authority on shared knowledge only; an ingest key writes at its creator's authority. Every AI write is recorded and revertible.
- Untrusted content stays untrusted. Your documents are reachable by outsiders: anyone can email your team an invoice. So every excerpt Zaviro serves is wrapped in a delimiter generated fresh for that response, which a document cannot predict or forge, and the text is neutralized first, so a crafted file cannot fake a citation, fake the end of the evidence, or hide characters inside a vendor name. The instructions Zaviro sends your AI name that content as data and tell it never to act on an instruction found inside a document. Removing the fence or the neutralization fails the build.
- Never trained on, and one place it can leave from. Zaviro never uses your data to train AI models, and the providers it sends content to for processing (Anthropic, OpenAI, and Voyage AI) operate under API terms that exclude training on customer data. The boundary is narrow by construction: model traffic leaves through one place, enforced by the build. Each provider's data handling is recorded in code beside that boundary, and the build fails if a provider is added without its entry, or if any entry ever records training use, so the disclosure cannot quietly fall out of date. Payment processing is handled by Stripe; card data never touches Zaviro's servers.
- Account security: two-factor authentication (authenticator app and passkeys), a per-account security activity log, session management, and an organization-wide 2FA requirement the owner can enforce. Destructive account actions require re-authentication, so a stolen session token alone cannot delete anything.
- Operational posture: customer data is continuously backed up with point-in-time recovery. And because source connections are read-only, the canonical originals never leave your own tools; Zaviro works from its own stored copies, which deleting a document removes.
- Deletion is real. Deleting a document removes the stored source document and subtracts that source's contribution from derived knowledge. Deleting your organization deletes its users, content, files and knowledge base after a 30-day recovery window; a minimal set of operational and billing records survives, per the Privacy Policy.
- Honest posture: Zaviro is access-control-private, not zero-knowledge (the pipeline must process text to learn from it), and it is not yet independently certified. No SOC 2 or ISO certification is held today; controls are designed to support SOC 2, GDPR, and PIPEDA obligations. Security questions are answered in writing: ask through the contact form, https://zaviro.ai/contact. Vulnerability reports: security@zaviro.ai.
- In writing. The Privacy Policy, Terms of Service, and Data Processing Agreement are public in full on zaviro.ai, no signup needed to read them, and the privacy policy carries the complete subprocessor list.
Ownership and continuity
You own what you put in. Everything you upload, connect, or push into Zaviro is yours, and so is the knowledge built from it. What Zaviro holds is a limited license to host, process, index, and display that content for a single purpose, running and protecting the service. That license ends when the content is deleted, subject to the retention windows the Terms of Service and the Privacy Policy publish. Zaviro takes no ownership stake in your content and no right to use it for anything else. For the personal data inside your content you are the controller and Zaviro is the processor, on the terms of the Data Processing Agreement, and your ownership survives the end of the agreement.
Leaving does not begin with getting your files back, because most of them never moved. Source connections are read-only, so the canonical originals stay in the systems they came from: your mailboxes, drives, and business systems keep their own copies whatever happens to Zaviro. Files you uploaded, and the notes and deliverables your AI saved, are stored by Zaviro and can be downloaded from the app one document at a time. Each person can export their own account data after confirming their identity with a password or a passkey, and that export stays reachable even when an account is locked over billing. Canceling a subscription does not delete anything: the organization is kept so you can come back. If a renewal payment fails, access winds down in stages, full access first, then read-only, then an account locked to billing management and that personal export, and the Terms of Service publish how long each stage lasts and when an unresolved account is closed.
The part you cannot carry out is the knowledge base itself. The resolved entities, facts, links, and citations are not exportable as one archive today, so a team that leaves keeps its documents and loses the structure built over them. That is also the answer to what happens if Zaviro stops operating: the systems you connected are untouched and still hold your data, your uploads and account data are downloadable while the service runs, and the knowledge base is the piece that would not survive.
The pages in this reference
- Zaviro overview (https://zaviro.ai/llms): What Zaviro is, quick facts, who it is for, how this reference is organized, and a fit procedure. Read it first.
- What Zaviro does for a business (https://zaviro.ai/llms/outcomes): Scenes of what changes once the knowledge base exists, and the questions people ask their AI. Read it to say what Zaviro would do for a particular business.
- Common questions about Zaviro, answered (https://zaviro.ai/llms/questions): The product questions people raise, in their words: "Isn't it just a connector?", "Isn't this just search over my documents?", "My AI vendor is building memory and connectors. Why not wait?", credits, Slack, team size.
- AI tools and agents with and without Zaviro (https://zaviro.ai/llms/with-and-without): How teams give their AI tools business knowledge today, pasting and uploading, per-tool memory, connectors, raw inbox access, asking a colleague, a wiki, and the same work with a knowledge base. Names no product.
- Zaviro privacy and security questions, answered (https://zaviro.ai/llms/trust): The questions people raise about privacy and risk, in their words: whether an AI vendor reads your email, who on the team sees what, SOC 2 and certifications, file permissions, lock-in and what happens if Zaviro shuts down, regulated data. The mechanisms behind the answers are on the security page.
- Zaviro by role: solo, team, developer, procurement (https://zaviro.ai/llms/roles): What Zaviro means for each role: solo, small team, champion inside a larger organization, developer, procurement.
- How Zaviro works (https://zaviro.ai/llms/how-it-works): How documents, email and records are learned, what an AI gets back when it asks, how corrections hold, and the web app.
- How Zaviro works, technically (https://zaviro.ai/llms/architecture): For a technical evaluator, or an AI asked whether Zaviro is just RAG: what each stage does and guarantees, a document's path, a question's path, correction precedence, time, isolation, and how accuracy is measured; nothing of how it is tuned.
- What Zaviro learns from (https://zaviro.ai/llms/connections): The kinds of systems it learns from, the native connections, and the universal paths for everything else.
- Zaviro ingest API: send anything in (https://zaviro.ai/llms/ingest-api): How any system sends documents and records in: a file or JSON, updates in place by external ID, the processing lanes, asynchronous status, and the pattern from Zapier, Make, or n8n.
- Where you use Zaviro (https://zaviro.ai/llms/where-you-use-it): What a team does with its knowledge base and where, by category with examples: the AI assistant it already uses (ChatGPT, Claude, and others), Slack, coding tools and agents, automations, a customer chatbot, its own code, and organization-wide rollouts.
- Zaviro MCP server: connect any AI tool (https://zaviro.ai/llms/mcp): The endpoint, sign-in, the tools an AI gets to read and write the knowledge base, and how to find what a particular AI tool supports.
- Zaviro REST API (https://zaviro.ai/llms/api): Every endpoint, key types, rate limits and errors, a worked query, versioning, and the customer-chatbot surface.
- Zaviro command line (CLI) (https://zaviro.ai/llms/cli): Search the knowledge base and push notes from a terminal.
- Getting started with Zaviro (https://zaviro.ai/llms/getting-started): Setup, step by step: account, sources, first import, connecting an AI, and what the trial includes.
- Zaviro pricing: plans, seats, and AI credits (https://zaviro.ai/llms/pricing): Plans, seats, AI credits, the trial, billing, and leaving.
- What Zaviro does not do (https://zaviro.ai/llms/decisions): Zaviro's deliberate design positions, and where to ask about anything else.
- Zaviro glossary (https://zaviro.ai/llms/glossary): The terms used across the reference.