OpenZulu Data Protection and Shared Responsibility

An assistant that can work with messages, files, or connected accounts needs more than a broad promise that it is “secure.” Customers need to know what protections exist, which providers participate, and where their own responsibility begins.

Current service protections

OpenZulu serves supported traffic over encrypted connections using TLS. Sensitive connected credentials are encrypted at rest. Supported Google connections use the permissions displayed during authorization and can be disconnected from the customer dashboard.

OpenZulu does not sell conversation data or use it to train third-party AI models.

Model and service-provider processing

To generate a response or carry out supported work, messages and relevant context are processed by the AI model provider and other service providers needed to operate the product. That is different from OpenZulu selling the data or using it to train a third-party model.

The Privacy Policy describes the current categories of information and providers. It should be reviewed before connecting an account with sensitive business or personal data.

Shared responsibility

Managed infrastructure does not remove the need for customer judgment. Customers decide which accounts to connect, which permissions to grant, what information to provide, and whether an output or proposed action is appropriate.

Use least-privilege access. Keep credentials and unnecessary secrets out of conversation. Review generated facts, code, recipients, files, and commitments before relying on them.

No absolute guarantee

No online service or AI system can promise zero risk or perfect output. OpenZulu’s role is to operate the managed service and its controls; the customer’s role is to use the service within appropriate boundaries.

For the legally operative details, read the current Privacy Policy and Terms of Service.