Tenant-isolated data
Every query is scoped to a tenant in the data layer rather than relying on each query to remember. One customer's agents cannot reach another's tickets, knowledge or reports.
Security and data protection
What we actually do with your data, and what we do not claim.
Support tickets are among the most sensitive data a business holds: names, contact details, order histories, complaints, sometimes payment references. This page describes the controls that exist in the product today. Where something does not exist, it says so.
Separation and access
The two questions every support buyer asks first: can another customer see our data, and can our own staff see more than they should.
Role-based permissions
Privileged routes check a named permission, not merely that somebody is logged in. Roles and team access are configurable per workspace.
Argon2 password hashing
Agent passwords are hashed with Argon2, the current password-hashing standard, rather than a general-purpose hash.
No account enumeration
A failed login costs the same time whether the address exists or not. Equalising that closes a leak where identical error text still reveals real accounts through response timing.
Rate limiting
Public and authenticated endpoints are rate limited, including the intake routes that anyone on the internet can reach.
Encrypted provider credentials
API keys you supply for an AI provider are encrypted at rest rather than stored as readable text.
What the AI sees, and what is removed first
This is the part most support tools are vague about, so here it is precisely.
Redacted before the boundary
Email addresses, payment card numbers, phone numbers, provider credentials, and Aadhaar, PAN and GSTIN numbers are replaced before a request reaches an external model, then restored in the finished draft. Names and free-text details are not removed.
Grounded in your own knowledge
Answers are drafted from articles in your knowledge base, and only the articles actually cited are attached to the draft. Whether a draft counts as grounded is decided by the server, not reported by the model.
A person approves every reply
There is no action in the automation system that sends a customer-facing AI reply on its own. Automation handles tagging, priority, routing, assignment and status; a human decides what is said.
Stale sources are flagged
A cited article past its review date is marked on the draft, so an agent can see the answer rests on something nobody has checked recently.
Cached output is treated as personal data
A cached draft contains the restored personal values, so it is purged on erasure along with everything else. An erasure that skipped the cache would quietly leave the data behind.
No source means no answer
When nothing in your knowledge covers a request it goes to an agent rather than getting a guess. That is the designed outcome, not a failure.
The mechanism is described in more detail in how grounded AI works.
Retention, export and erasure
India's Digital Personal Data Protection Act, 2023 gives people rights over their data, and those rights are worth nothing if the software cannot act on them. Rezolo Desk has the operations built in rather than leaving them as a manual database job.
Data subject export
Returns a customer's record, their tickets and the messages they sent. Permission-gated, and the request itself is written to the audit log.
Data subject erasure
Anonymises the customer record, erases the message bodies they wrote, and purges cached AI output for them.
Configurable retention
Retention periods are set per workspace rather than fixed by us, because how long a support record should live is your policy decision.
Deletion on exit
Your support data is deleted when you leave. It is your data while you are a customer and it does not become ours afterwards.
Immutable audit trail
Every mutation writes a tenant-scoped audit event. Personal detail is redacted inside the log entries themselves, so the audit trail is not a second copy of the data it describes.
Attachment controls
What file types and sizes may be attached is a workspace policy, enforced server-side rather than only in the browser.
What we do not claim
A security page that only lists strengths tells you nothing, because every vendor's page looks the same. These are the honest gaps, stated here rather than discovered by your legal team three weeks into an evaluation.
No SOC 2 or ISO 27001
Rezolo holds no third-party security certification and has not commissioned an external penetration test. Everything on this page is engineering we can demonstrate, not an audit somebody else has signed.
No DPDP compliance certificate
The product is designed around the DPDP Act, 2023 and implements the operations it requires. That is a design commitment, not a certified compliance status, and nobody can issue you the latter today.
No data-residency guarantee
We do not currently offer a choice of storage region. If residency is a hard requirement, raise it during onboarding so we can be straight about whether we fit.
No SSO or two-factor sign-in yet
Agent sign-in is email and password today. If your security policy requires SSO or enforced MFA, tell us early rather than late.
Redaction is not anonymisation
It removes structured identifiers, not every trace of a person. Names and details written in free text reach the model, and national identifiers from outside India, such as SSNs, Emirates IDs or IBANs, are not yet recognised.
Early access, and priced accordingly
Rezolo Desk is onboarding a selected group of early teams. You should weigh that alongside everything above rather than treating this as a mature enterprise platform.
Security questions
- Is customer data sent to an AI model?
- Ticket content is, with structured identifiers removed first. Email addresses, payment card numbers, phone numbers, provider credentials, and Aadhaar, PAN and GSTIN numbers are replaced before the request reaches an external model, then restored in the finished draft so the reply still reads naturally. This reduces exposure; it is not anonymisation. Names and details written in free text do reach the model, and identifiers from outside India, such as a US Social Security number or a UAE Emirates ID, are not yet recognised.
- Can the AI send a reply to our customer on its own?
- No. Rezolo Desk drafts and an agent approves. There is no action in the automation system that sends a customer-facing AI reply unattended. Automation changes ticket state, tags, priority, assignment and routing, which is the mechanical work rather than the answering.
- What happens when a customer asks for their data?
- There is a built-in export that returns that customer's record, their tickets and the messages they sent, and the request itself is written to the audit log. It is permission-gated, so only someone with settings access can run it.
- What happens when a customer asks to be erased?
- The customer record is anonymised, the message bodies they wrote are erased, and cached AI output for that customer is purged as well. That last part matters: a cached draft holds the restored personal data, so an erasure that skipped the cache would leave the data behind.
- How is support data separated between customers?
- Every query is scoped to a tenant, and the scoping is applied in the data layer rather than left to each individual query to remember. One customer's agents cannot reach another customer's tickets, knowledge base or reports.
- Are you SOC 2 or ISO 27001 certified?
- No, and we will not imply otherwise. Rezolo is an early-stage company and holds no third-party security certification. What this page describes is engineering that exists in the product and can be demonstrated, not an audit anyone else has signed off.
- Where is data stored?
- Support data is stored in our cloud infrastructure. We do not currently offer a data-residency guarantee or a choice of region, and we would rather say so than leave it ambiguous. If residency is a hard requirement for you, tell us during onboarding so we can be straight about whether we fit.
Something here not covered, or need detail for a security review? Write to hello@rezolo.in and we will answer specifically. Our website privacy practices are in the privacy and DPDP notice.
Talk to us
Have a support queue you want to fix? Write to us.
Reach out at hello@rezolo.in. We will understand your requirements first, then guide you on the commercials.