Security and data handling
Zilch holds your compliance documents, supplier details and product data. This page explains where that data is kept, who can see it, how our AI uses it, and what leaves your account only when you send it.
Last updated
At a glance
- Hosted in Australia. Your organisation’s data is kept in Australian data centres.
- Other countries for Enterprise. On Enterprise plans, we can host your data in another country where a data centre is available.
- Private to your organisation. Only people your organisation invites can see its account.
- Encrypted in transit and at rest.
- Nothing goes to a buyer unless you send it. AI drafts, and a person at your organisation approves every answer.
- Not used to train AI models.
Where your data is hosted
Zilch’s database, document storage, sign-in and app are all hosted in data centres in Australia.
For Enterprise customers that operate in other countries or have their own data residency requirements, we can host Zilch in another country, provided a data centre is available there. Email info@tryzilch.com to discuss where your data needs to be.
Who can see your data
- Each organisation’s documents, products, suppliers and questionnaires are kept separate. The Zilch API checks which organisation you belong to on every request, and the database and file storage enforce the same separation.
- People join your organisation’s account by invitation. Your admins manage the team and can remove someone’s access at any time.
- Compliance documents are kept in private storage, not at public web addresses. A document is seen outside your team only when you share or publish it.
- A small number of Zilch staff can access accounts to provide support and keep the service running.
Encryption, sign-in and payments
- All traffic to the Zilch app and API is encrypted with HTTPS (TLS).
- Data is encrypted at rest by our database and storage provider, using AES-256.
- Passwords are stored hashed, never in plain text.
- Card payments are handled by Stripe on its own payment pages. Zilch never sees or stores your card number.
How Zilch uses AI
Zilch uses AI to read your documents, draft answers to buyer questionnaires, draft policies and estimate product footprints. To make a draft, Zilch sends our AI providers the text that draft needs: the question, and the relevant parts of your documents and data. Under our AI providers’ commercial terms, data we send them isn’t used to train their models.
- Drafts are checked against your documents before you see them. A quoted fact has to appear in the document it cites, and a question your documents don’t answer is shown to you as a gap rather than guessed.
- A person at your organisation approves every answer before it can be used. Approved answers are saved so the same question gets the same answer next time.
- The Zilch browser extension enters approved answers only when you click Fill the form, and never submits a form for you.
What leaves your account, and when
Nothing goes to a buyer unless you send it: an exported questionnaire, a report, a shared link or your public profile.
- Your public profile is off until you switch it on. For each document you choose whether visitors can download it, ask for it, or not see it at all.
- When a visitor asks for a document, a person at your organisation approves the request before anything is sent. The link they receive expires after 14 days.
- Distributors can share reports and product results pages under their own name instead of their supplier’s, and an unbranded results page doesn’t name the supplier.
The browser extension
On the form you open, the extension reads only the wording of each question and its answer options. It doesn’t read what you type, passwords, attached files or any other page you visit. Details are in our privacy policy.
Service providers
These services process data on our behalf to run Zilch:
| Provider | What it does for Zilch |
|---|---|
| Cloud hosting | Database, document storage, sign-in and the Zilch app, in Australia |
| AI providers | Read documents and draft answers, policies and footprint estimates |
| Stripe | Card payments and billing |
| Email delivery | Sends Zilch’s emails, such as invitations and document requests |
| Error monitoring | Helps us find and fix faults |
This website, tryzilch.com, also uses an analytics service to measure visits and a live chat service.
Keeping and deleting your data
Your data stays in your account while you use Zilch. To have your account and its data deleted, email info@tryzilch.com.
Security questionnaires and reporting an issue
If your procurement team needs a security questionnaire completed, or you think you’ve found a security issue in Zilch, email info@tryzilch.com. For an issue, include the steps to reproduce it.