Security

How Zaqa protects your data

Zaqa reads your customers' purchase orders and quote requests, your pricing and your catalog, and writes into the system you run your business on. Here is how we keep that data private and that access under your control.

Visit our Trust Center (opens in a new tab)Request the SOC 2 report (opens in a new tab)
AICPA SOC

Independently audited, independently tested

An independent auditor has audited Zaqa's security controls for SOC 2. Every year, an outside security firm also tries to break into the Zaqa application and API, then tests again to confirm the findings are fixed.

Customers and prospects can request the SOC 2 report and both penetration test reports from our Trust Center.

Protections

Safeguards built into Zaqa

Encrypted in transit and at rest

Data moves over TLS 1.2 or higher and is stored with AES-256 encryption.

Your data stays yours

Every record is scoped to your organization and never used to train models for other customers.

Data residency

Customer data is stored on AWS in the United States, with disaster-recovery copies in a second US region. Customers who need their data kept in another country can have a dedicated deployment in their own region.

Least-privilege access

Only staff who need access have it, behind multi-factor authentication. Every employee passes a background check.

Every action audited

Every action by Zaqa's AI agents and by your team is recorded: what changed, who changed it and who approved it. Your team can see the full log in the app.

Independent security testing

An outside firm penetration-tests the Zaqa application and API every year. Between tests, every container image is scanned for vulnerabilities and Amazon GuardDuty watches production for threats.

Your ERP

Zaqa prepares the work. Your team makes the call.

Zaqa creates the records your workflow needs, such as sales orders, quotes and purchase orders, and changes an existing record only when your team approves the change. How it connects depends on your ERP. We agree on the method and the access pattern with your team during onboarding.

  1. Zaqa prepares the draft

    Zaqa reads the incoming document and its attachments, matches the lines to your catalog and pricing, and flags anything it is unsure of.

  2. Your team approves it

    A person reviews every sales order, quote or purchase order in Zaqa, edits what needs editing, and approves it. Nothing reaches your ERP before that.

  3. Zaqa writes only what you approved

    Zaqa writes through your ERP's supported integration, with its credentials encrypted in AWS Secrets Manager. We recommend a dedicated, least-privilege ERP user, so you can audit Zaqa's activity and revoke it at any time.

FAQ

Questions from your security team

Your data is never used to train models for other customers, or to train the AI provider's own models. Zaqa may tune models specifically for your account; that tuning is kept with your account's data and never shared with other customers.
On AWS in the United States (us-east-1), with disaster-recovery copies in us-west-2. AI processing runs on Google Cloud. The full list of subprocessors is on our Trust Center at trust.zaqa.ai.
Your customers keep ordering exactly as they do today, by email, PDF or fax. They don't need a portal or a login. The documents they send get the same protection as the rest of your data: encrypted, kept within your account, never used to train models for anyone else, and deleted with your data.
Yes. Request it from our Trust Center at trust.zaqa.ai, along with the penetration test and remediation reports.
It depends on your ERP. Typically a dedicated integration user that can create the records your workflow needs, such as sales orders, quotes and purchase orders, and read your catalog. We agree on the method and the access pattern with your team during onboarding, and you can revoke it at any time.
Yes. If your ERP is hosted on your premises and you'd rather not expose it to the internet, Zaqa can connect over a dedicated site-to-site IPsec VPN to your firewall. It's optional: we agree on the connection model that suits your network during onboarding.
Yes. Zaqa supports SAML single sign-on with your identity provider, such as Okta, Microsoft Entra ID or Google Workspace. We set it up with your IT team during onboarding.
Yes. Zaqa records every action taken by its AI agents and by people on your team: what changed, who or what changed it, who approved it and when. The log is visible to your team in the Zaqa app, so you can trace any sales order, quote or purchase order from the original document to what reached your ERP.
Zaqa deletes your data within 60 days of termination, including derived data such as embeddings and training datasets.
Yes. Send it to security@zaqa.ai. Most answers are also on our Trust Center. The same address is how to report a vulnerability or a security concern.

Bring your security team

We'll walk your IT and security reviewers through the controls, the reports and the ERP access that matter for your rollout.