Security
Your data is yours. Nobody here reads your mail.
You are handing us the inbox your customers write to. That deserves a straight answer rather than a page of diagrams, so here are the three things most people want to know — in plain words, with the technical detail underneath for whoever looks after your IT.
1. Terazul staff cannot read your correspondence
Running the platform and reading your mail are two different things. Our people keep the service up — deployments, capacity, incidents — and that job does not come with access to your messages. If someone genuinely needs to look further to fix a live problem, it takes a deliberate, time-bounded elevation, and the elevation itself lands in your audit trail where you can see it.
2. You decide what sends without you — and you can stop it
Nothing goes out on its own unless you have said it can. You choose that per kind of message, so routine things can run automatically while anything sensitive waits for a person. Change your mind and you can pull everything back to review, or stop automatic sending outright, without calling us first. A new account starts with human review on everything, so autonomy is never something you end up with by accident.
3. Your data stays yours
Your correspondence is never mixed with another company's — competitors on the same platform cannot see each other, and that separation is the thing we protect ahead of speed and ahead of cost. We do not train models on your content. It grounds your answers and nobody else's. Your data is exportable while you are with us, and deleted when you leave.
In transit and at rest
Encrypted both ways
Sign-in
Multi-factor and SSO included
Training data
Never your content
If it goes wrong
You hear it from us
The basics
Covered, and not sold back to you
The controls that keep an account safe are not a premium tier. They come with the product, because an account without them is a risk to you and to us.
- Locked down in both directions
- Your data is encrypted while it travels to us and while it sits with us. We can tell you exactly where it is stored and processed — just ask.
- Sign-in you control
- Multi-factor as standard, and you can connect your own company sign-in — Okta, Entra ID, Google Workspace, or anything else that speaks OpenID Connect — so that removing someone from your systems removes them from Broa too.
- People only see their part
- What each person can read, approve or send is a role you set. The screen shows them what their role allows and nothing else.
- The AI vendor does not keep your messages
- The models we use to draft replies do not retain your content or learn from it. We will name every outside service that touches your data.
- Leaving is straightforward
- Export your correspondence, settings and audit trail whenever you want, and we delete what we hold when you go. Your mailbox was always yours.
- Bad news travels fast
- If there is an incident that touches your data, you get told promptly and honestly, with what we know and what we are doing — not a notice weeks later.
Your reputation
It will not embarrass you in front of a customer
The risk that keeps people awake is not a breach. It is a confident, wrong reply going out with your company's name on it. These checks are the same whether a person is reviewing or the message is sending automatically.
It answers from your facts, or it asks a human
A reply has to come from your own catalogue, orders, policies and past threads. When Broa cannot back an answer up, it hands the message to your team instead of guessing well. That holds at every level of autonomy, including full.
Every draft is checked before it exists
Generated text is validated before it can reach a person or a send button. A draft that fails cannot be released — a reviewer cannot wave it through, and no automatic setting can either.
Hostile email cannot take the wheel
Anything arriving from outside is treated as untrusted, whatever channel it came through. It is handled so it cannot run instructions of its own, and held back when it looks wrong.
You can see exactly what happened
Every message, draft, approval and send is on the record, along with who looked at what. When a customer asks why they got a particular reply, you have the answer rather than a shrug.
For your IT person or your auditor
The same promises, with the mechanism shown
If someone technical is looking at this on your behalf, here is what sits behind the plain-language claims above.
Isolation in layers
Tenant context travels explicitly with every request rather than being inferred, and is enforced at each boundary it crosses. One check in one place is a check the next service forgets.
Partitioned stores
Retrieval, configuration, drafts and audit are scoped per tenant. A query that does not name a tenant does not run.
Workspaces inside the boundary
A brand, a region or a single mailbox can have its own configuration and users, and stays inside your isolation boundary.
Audit that cannot be skipped
Audit is not a library a service may choose to call. Where the record cannot be written, the operation does not quietly proceed unrecorded. Reads are captured, not just writes.
Tamper evidence
Events are chained, so a record altered or removed after the fact can be detected rather than merely suspected. The trail is yours to query and export without asking us to run a report.
Retention with an end to it
Content and metadata have separate retention, so the record that something happened can outlive the content itself.
Identity
Credentials, multi-factor and sessions live with a dedicated identity provider. Federation is per-tenant OpenID Connect — authorization-code flow with PKCE, the home realm resolved from the email domain — so any OAuth 2 / OIDC provider works. SAML is on the roadmap and not shipped; we would rather say so than imply it.
Authorization at the service
Roles and permissions are enforced in the services themselves, not hidden in the interface.
At the edge
A gateway terminates TLS and applies rate limiting and IP allow-listing before a request reaches any service.
Getting security questions from your own customers?
Send us the questionnaire. We will help you answer the parts that are about us.