How we handle your data, and the platforms we trust with it.

🧭 Our approach: two deployment models, both transparent.

Zelix Labs is a Singapore-based agency operated by Zeta Media Pte Ltd, a Singapore-registered company. A dedicated Zelix Labs Pte Ltd entity is currently in registration; until then, all agreements, invoices, and data-controller obligations rest with Zeta Media Pte Ltd. We do not own or operate a customer data platform of our own. What we do is design, configure, deploy, and maintain AI agent systems on top of third-party platforms that already carry SOC 2 or ISO 27001 certifications. For every engagement, we operate in one of two deployment models. Your specific build document records which model applies to you.

Everything else on this page applies equally to both models. The certified platforms, the data flow, the PDPA posture, the access controls, the incident response SLAs: the same commitments regardless of who holds which account.

🏛️ The platforms we build on.

Every active Zelix deployment runs on some combination of the platforms below. Your specific build document names which ones apply to you. All certification claims here refer to each vendor's public attestations, not Zelix's.

The platforms below apply regardless of deployment model (see §01). In Client-owned mode, you hold the accounts directly. In Zelix-managed mode, Zelix holds the designated platforms on your behalf under a signed DPA. The certifications and data locations are the same either way.

Understanding SOC 2 and ISO 27001

Every vendor we rely on holds one or both of two industry certifications. If your procurement team has asked about security posture, they almost certainly asked about these. Here is what each one actually means, in plain language.

The five Trust Service Criteria SOC 2 can audit

A SOC 2 report covers one or more of these five areas. The more the vendor opts into, the broader the audit. Most SaaS firms include Security at minimum; the strongest vendors include all five.

SOC 2 Type I versus Type II

You will see both quoted. The difference matters. When a vendor says "SOC 2 Type II", that is the stronger attestation.

Side-by-side comparison

Our platform stack

🔁 How data flows through your deployment.

The path a single customer message takes through a typical Zelix deployment on respond.io with AI agents. Every link in the chain is a named platform above.

Throughout this flow, Zelix team members may observe conversations inside respond.io for weekly review and quality improvement, but we do not transit conversation data through our own infrastructure.

🇸🇬 PDPA alignment (for Singapore clients).

Singapore's Personal Data Protection Act 2012 (PDPA), updated 2020 and 2021, governs the collection, use, disclosure, and care of personal data. For your Zelix deployment, you are the Data Controller and Zelix is acting as your Data Intermediary under Section 2(1) of the Act.

As your Data Intermediary, our obligations and commitments are as follows.

• Purpose limitation. We process your customer data only within the scope of our written engagement with you. We do not process it for any other purpose, including Zelix marketing, internal analytics, or benchmarking across other client deployments.
• Protection (Section 24). We maintain reasonable security arrangements appropriate to the personal data we handle, including two-factor authentication on all internal accounts that can access client platforms, access on a least-privilege basis, and device-level encryption on team laptops.
• Retention limitation. We do not retain personal data beyond the active engagement plus the offboarding window (see section 8 below). Internal working documents related to your deployment are deleted or anonymised within 30 days of engagement closure.
• Access and correction (Sections 21 and 22). If one of your customers makes an access or correction request, we will help you execute it on your respond.io or GHL account within the timelines PDPA requires.
• Transfer limitation (Section 26). Personal data may be transferred outside Singapore when using platforms hosted overseas (see section 2 above). These transfers occur under each platform's published data-transfer safeguards. We can provide the relevant links on request for your compliance file.
• Data breach notification. Under PDPA's mandatory breach notification framework (effective February 2021), if we become aware of a notifiable breach (one that is likely to cause significant harm or affects 500 or more individuals), we will notify you within 24 hours so you can meet your own 3-calendar-day notification deadline to the PDPC.
• Accountability. Ryan Chua is the named contact for all security and data concerns. Contact details are at the foot of this page.

For clients on the Zelix-managed deployment model (see §01), we sign a Data Processing Agreement (DPA) with you before the engagement starts. The DPA codifies the PDPA obligations above as a contract between us, names the subprocessors we use, and covers breach notification and deletion on termination. The template is available on request, and is typically signed as part of engagement onboarding.

🚫 What we never do with your data.

Some of the strongest commitments are the ones we can state in the negative. These are absolute.

• We do not train AI models on your customer conversations. OpenAI does not train on API data by default. respond.io does not train on your workspace data. No Zelix-specific model exists that we would train on your conversations even if we could.
• We do not share your data, prompts, or deployment configurations with any other client. Each Zelix engagement is siloed at both the platform level and our internal process level.
• We do not sell, rent, or monetise your data in any form. Our commercial relationship with you is a retainer for professional services. That is the only revenue we take from your engagement.
• We do not retain copies of customer data after your engagement ends. Build documents and internal working files are deleted or anonymised within 30 days of offboarding, except where retention is legally required (for example, invoices and tax records, which we retain for 5 years per Singapore IRAS requirements but which do not contain customer-level data).
• We do not use your deployment as a public case study without your written permission. Any client name, screenshot, or data point that appears in Zelix marketing comes from clients who have explicitly signed off.

🔑 Access controls on our side.

• Named access only. Every Zelix team member who touches your accounts is named in your build document. Typically two or three people: a senior operator, a reviewer, and (for ad-heavy deployments) a paid-media specialist.
• Least privilege. We request the minimum platform role necessary. If "agent" access on respond.io is enough, we do not request "owner" access.
• No shared credentials. Every team member logs in with their own identity on each platform. We do not share passwords or use shared inboxes to access client platforms.
• Two-factor authentication. Mandatory on every internal account that can reach a client platform.
• Revocation is one click. You can remove any Zelix team member's access at any time through your platform's user-management panel. Access revocation is instant on the platform side. We ask that you notify us at the same time so we can update our internal records.
• Offboarding our own team members. When a Zelix team member leaves the company or rotates off your project, we remove their access from every client platform within one business day of the rotation taking effect.

📁 Where Zelix keeps working documents.

Beyond the platforms above, Zelix maintains a small set of internal working documents per engagement. These contain configuration notes, knowledge base source files, prompt histories, change logs, and sometimes anonymised test conversations. For full transparency, here is where they live.

• Google Workspace (Drive, Docs, Sheets). Build documents, source knowledge base files, and change logs. Google Workspace is SOC 2 Type II, ISO 27001, and ISO 27018 certified. Access is restricted to the named project team.
• Notion and Airtable. Client trackers and feedback logs. Both are SOC 2 compliant. Access restricted to the named project team.
• WhatsApp groups. Day-to-day communication with your internal team. Screenshots of agent behaviour, flagged issues, and quick fixes flow through these groups. End-to-end encrypted in transit per WhatsApp's standard. Messages are retained on the devices of participants per WhatsApp's default policy.

Where possible, we keep customer-identifiable data out of these internal systems. Screenshots shared in WhatsApp groups are pseudonymised where practical (customer name and phone number blurred). When a screenshot genuinely needs to show the problem, it remains in the group for the duration of the active engagement and is deleted during offboarding.

👋 When your engagement ends.

Whether you pause a retainer, move to another agency, or bring operations in-house, here is exactly what happens.

• Your platform accounts stay with you. respond.io, GHL, Meta Business Manager, Make.com, and every other platform we configured remain in your name under your billing. Nothing needs to transfer.
• We remove our access within 5 business days. Our team members are removed from your platform user lists. You can also do this yourself immediately.
• We delete internal working documents within 30 days. Google Drive, Notion, Airtable records related to your deployment are deleted or fully anonymised. Our retention of invoices and tax records is separate and required by Singapore law (IRAS, 5 years).
• You get a final change log and handover note. On request, we export the full change history of your deployment and send it to your team before closing.
• WhatsApp groups close. Active WhatsApp groups between Zelix and your team are closed. Messages remain on participants' devices per WhatsApp's defaults; we delete them from our side where the group is archived.

🔒 Sensitive data in chat.

Your AI agents are explicitly instructed, under the Zelix AI Agent Standard at zelixlabs.com/ai-standards, never to request, store, or repeat sensitive data in chat. This covers:

• Payment card numbers, CVVs, or expiry dates
• Passwords, OTPs, or authentication codes
• Full ID or passport numbers
• Full dates of birth
• Specific medical records or diagnoses

Where payments are required, they are routed through external gateways (Airwallex, Stripe, Meta Pay, or your preferred provider) using secure links sent inside the chat. The customer completes the transaction on the gateway, not the chat window. Zelix agents never see card details.

If sensitive data is accidentally shared by a customer (some customers do paste their NRIC or their card number unprompted), the agent is instructed not to quote it back and to route the conversation to a human operator on your team for appropriate follow-up.

🚨 Incident response.

If a platform we rely on has an incident

• Our team monitors vendor status pages continuously. OpenAI's status page in particular is on our live watch: status.openai.com.
• If your deployment is affected, we notify you within one business day with what happened, what your exposure is (or is not), and what is being done upstream.
• If the incident rises to the level of a PDPA notifiable breach (significant harm or 500+ individuals affected), we assist with your 3-day notification obligation to the PDPC.

If Zelix itself experiences an incident affecting your data

• We contain and begin investigating within 24 hours of discovery.
• We notify you within one business day with scope, impact, and ongoing actions.
• We assist with any PDPA or GDPR notification you are required to file.
• We publish a written post-incident report to you within 14 days covering root cause, remediation, and prevention. If the incident affected more than one client, we anonymise the report across accounts.

📋 Subprocessor list.

The third parties that may process personal data as part of running your Zelix deployment. In Client-owned mode (see §01), you have directly accepted each platform's standard Data Processing Terms on signup. In Zelix-managed mode, Zelix operates the designated platforms on your behalf, and we sign a per-client DPA that names these subprocessors explicitly and governs how Zelix handles your data on its own tenancy. A DPA template is available on request.

If we add a new subprocessor that materially changes your data handling, we notify you in the monthly digest and update this page with a dated changelog entry.

📌 Version & changelog.

This page is versioned. Material changes (new subprocessors, changed SLAs, new retention rules) produce a new version with a dated entry below. Clients on an active retainer receive a one-line email for every version bump.