Hosting and architecture
Zime runs on Amazon Web Services in the US East (N. Virginia) region, across three availability zones. It is a multi-tenant cloud service: every customer uses the same continuously updated version. Each customer's data is separated by company, and what a person can see follows their role in the product.
Meeting recordings are stored with Backblaze or Google Cloud in the United States. See Privacy and data protection for where each kind of data lives.
How your data moves through Zime
- 1. Record. A meeting on a connected calendar is recorded by the Zime notetaker, or by Microsoft Teams or Zoom itself where native recording is on. Zime receives the recording and the transcript.
- 2. Match. Zime reads the related records from your CRM and links the conversation to its deal and account.
- 3. Analyse. A custom AI brain, set up for your sales motion, analyses each conversation.
- 4. Write back. Where you have turned it on, Zime writes insights to the CRM record and logs the call.
Storage. CRM data, transcripts and insights: AWS US East (N. Virginia). Meeting video: Backblaze or Google Cloud, United States.
Encryption
In transit: Zime's application endpoints accept TLS 1.2 and TLS 1.3 only.
At rest: databases and file storage on AWS are encrypted with AES-256. Database keys are managed in AWS Key Management Service.
Access control
Access to Zime's systems is role based and follows least privilege. Multi-factor authentication is mandatory for AWS, Google Workspace, VPN and all production systems. Production access is reviewed every quarter, and access is removed within three days of an employee leaving.
Your users sign in to Zime with Google or Microsoft.
Staff devices
Every device that reaches Zime systems, company issued or personal, runs an endpoint agent that continuously checks disk encryption, antivirus, screen lock and operating system updates. A device that fails the checks may not access company data. Customer data may not be stored on personal devices, and removable media or printing of customer data is prohibited.
Secure development and change management
Every change is recorded, reviewed, tested and approved before release, and the person who requests a change is not the person who approves it. Development and production are separate environments. Releases are built and deployed through an automated pipeline.
Vulnerability management and penetration testing
An independent firm tests Zime at least once a year. The latest test was in August 2026: every critical, high and medium finding was fixed and verified on retest, and the application was graded A+. The test covered the API layer, including authorization, token validation and CORS.
Fix targets by severity: critical 7 days, high 30 days, medium 60 days, low 90 days.
Logging and monitoring
Production access is logged, activity in the cloud account is recorded in an audit trail, and automated threat detection runs on production.
Incident response
Incidents are classified by severity. Response starts within 1 hour for a critical incident, 4 hours for high, 24 hours for medium and 72 hours for low.
Zime notifies you within 48 hours of becoming aware of a personal data breach that affects your data.
You can name a security contact or shared mailbox to receive these notices.
Backups and recovery
The main production database is backed up continuously, with point in time recovery for 7 days, and daily snapshots are kept for 14 days. It runs with a standby in a second availability zone; in a failover on 16 September 2026 the standby took over in 15 seconds. Applications are defined in code and can be redeployed from source.
Report a security issue
Write to support@zime.ai.