- Built for protected health information: PHI redaction you set per agent, retention periods you control, and access limited to the team that owns the data.
- We sign a Business Associate Agreement with healthcare customers, in place before the first patient conversation reaches the agent.
- Hosted on Google Cloud — SOC 2 Type II & ISO 27001 certified infrastructure.
- Calls, transcripts, recordings and records travel over TLS and are encrypted at rest; model keys you bring are sealed under AES-256-GCM.
Google Cloud · us-east4. Transcripts and recordings are stored in Northern Virginia, on SOC 2 Type II & ISO 27001 certified infrastructure.
Every conversation, under seal.
There’s no security tier to buy: every control below comes with every agent you run.
Your agent can’t be talked into what it was never handed.
You set every action a connector offers to Allow, Ask or Block, and the platform enforces that setting, not the prompt.
Front desk Connector actions
- Find an open slot
The model receivesfind_open_slotnothing,confirms firstnot in its tools
- Book the appointment
The model receivesbook_appointmentnothing,confirms firstnot in its tools
- Refund the deposit
The model receivesrefund_depositnothing,confirms firstnot in its tools
- Delete a customer record
The model receivesdelete_customer_recordnothing,confirms firstnot in its tools
An Ask action runs only once the person in the conversation hears or reads exactly what will change and says yes. With nobody there to answer, it doesn’t run.
Fifteen controls,
each shown doing its job.
ExampleYour data
Signed recording links
https://storage.googleapis.com/…/rec_2048.wav?X-Goog-Algorithm=GOOG4-RSA-SHA256&…&X-Goog-Expires=3600&…ExpiredEach playback link is signed and issued per request, and opens nothing an hour later; the store refuses public access.
24-hour recording deletion
Recording storage · Off
Recordings are deleted after 24 hours.
One switch for the whole organization; a daily sweep deletes the audio from storage.
Per-project knowledge
- namespace
- 8c1f0a52-…
- delete
- refund-policy.pdf
- vectors
- Deleted
Each project’s knowledge has its own namespace; a deleted document leaves the agent, vectors and all.
Redacted page typing
browser_type
{"ref":10,"value":"[redacted: 19 chars]"}
When the agent types into a visitor’s page, the record keeps the field and the length, never the value.
Credentials and connections
One-hour app tokens
POST /oauth/token grant_type=refresh_token
400 invalid_grant
that refresh token had already been used, so the connection was revoked
Apps you connect to Zumu, like Claude Desktop, get one-hour tokens; a disconnect ends them at once.
Standard OAuth
GET https://auth.crm.example/authorize?
…&code_challenge_method=S256
…&resource=
https%3A%2F%2Fmcp.crm.example The agent signs in to your systems by standard OAuth (RFC 7591, RFC 8707), each token bound to one server.
Sealed model keys
OpenAIa91FActive
Sealed with AES-256-GCM under a key held in Google Secret Manager, and never shown to the model.
Key check and rotation
Validate & rotate
provider rejected the key
Every key is checked with its provider on save and on each rotation; rotating needs no redeploy.
Access to the account
Single sign-on
Sign in to Kestrel
SAML · idp.kestrel.example
Google · Microsoft
Password + emailed code
Your team signs in the way it already does at work, through your own identity provider.
Roles and permissions
Supervisor · custom project role
- Agents
- View · Edit
- Members
- View
- Roles
- No access
Organization roles, project roles and custom permissions.
Account lockout
Zumu to sam@kestrel.example
Zumu sign-in locked after too many attempts (until 14:32)
Repeated failures lock the account and email its owner where the attempts came from.
Signed-in devices
Safari on iOS · 3 hours ago
203.0.113.24 · United States
Every member sees where they’re signed in, and signs out one device or all the others at once.
Oversight
Audit trail
- Sam Ostrowski
- +42 chars
- 2 minutes ago
- not published
- Leena Iyer
- −118 chars
- Yesterday
The audit trail keeps every prompt edit, drafts included — who, from where, when — and every feature switch, before and after.
Do-not-call check
- +1 212 555 0106
- Reached
- +1 212 555 0199
- Skipped
- On the do-not-call list
- +1 212 555 0173
- Voicemail
Each number is checked against the project’s do-not-call list as it dials. No readable list, no call — and anyone who asks not to be called again is added.
Allowed domains
Allowed domains · kestrel.example
shop.elsewhere.example : Refused
The widget answers only on the domains you list for that agent, and acts on a page only where you allow it.
Asked and answered.
Will you sign our BAA?
Yes. Ask for one with your security review, and it’s signed before your agent hears from its first patient.
Who at Zumu can see our conversations?
Our staff console has no conversation viewer. Conversations open in your own dashboard, for your organization. When support needs one, we ask you for it, and you decide what to share.
Can we have everything deleted?
Yes. Tell us, and your organization’s conversations, transcripts and recordings are deleted.
How long do you keep recordings?
For as long as you set on each agent, from 1 to 365 days and 90 by default, while recording storage is on for your organization.
How do we report a vulnerability?
Email hello@zumu.ai, the address our security.txt publishes under RFC 9116 at zumu.ai/.well-known/security.txt.
Ready when you are
Security is settled.
Let’s get you live.
Tell us what your team wants to run and who has to sign off on it. We take it from there.
- Agreements
- Our Data Processing Agreement, signed with every customer.
- Questionnaire
- Completed in full and returned in your own format.
- Architecture
- A data-flow write-up of your deployment.
- Timeline
- Your team builds and tests the agent while the review runs.
Your front door for every customer conversation.
- Phone
- Web
- SMS
- Messaging apps