Trust
Your data, isolated. Indian rules, enforced.
How we protect your leads, and how PropZolo keeps your team inside TRAI, DLT, DPDP and RERA.
Security
Defence in depth, by default.
- Tenant isolationEvery row carries your company ID and Postgres row-level security enforces it on every query.
- Two-factor sign-inMandatory TOTP for owners and admins; device binding and login approvals for teams.
- Masked numbersPhone numbers masked by role, every reveal audited, daily reveal quotas.
- Export controlsExports by permission, with row caps, approvals and watermarks — and alerts on bulk exports.
- Encrypted secretsIntegration keys are envelope-encrypted; passwords hashed with Argon2.
- BackupsContinuous backups with point-in-time recovery, tested restores and a second copy.
- Audit logLogins, exports, reveals, permission changes and deletes — append-only, kept for a year.
- Staff-exit wizardReassign leads, tasks, visits and listings and revoke devices in one step when someone leaves.
Compliance
India’s rules, checked on every send.
- TRAI 7-day enquiry windowPromotional SMS and calls to an enquiry are allowed for 7 days; after that only with registered consent. Checked at send time, with the enquiry kept as evidence.
- DLT registrationYour entity, headers and templates imported; every SMS is checked against its registered template before it goes.
- DND and quiet hoursPromotional sends scrub DND preferences and respect calling hours and your company’s quiet hours.
- WhatsApp 24-hour windowThe inbox shows the window; outside it, only approved templates can be sent.
- DPDP ActConsent ledger, versioned notices, rights requests with a 90-day clock, erasure that cascades, retention and legal holds.
- RERA on promotionsProject pages and promotional templates carry the RERA number; channel partners’ RERA numbers tracked with expiry.
- A2P call declarationsSoftware-initiated calling is declared with its caller IDs before it can run.
- One-tap opt-outSTOP works on every channel and is honoured everywhere, at once.
Permissions
Everyone sees only what they should.
- OwnerWhole companyEvery lead, report and export, with the audit log.
- Branch headTheir branchEvery lead, visit and report in their branch.
- Sales managerTheir teamTheir team’s leads, visits and reports.
- AgentOwn recordsTheir own leads. Numbers masked until revealed, every reveal logged.
- Channel partnerOwn recordsOnly the clients they registered, their visits and payouts.
Questions
Security, answered.
Where is my data hosted?
Application and database servers run in India (Mumbai). Media and backups follow the locations listed in the privacy policy, along with sub-processors such as Meta for WhatsApp.
Can PropZolo staff see my leads?
The PropZolo admin console is a separate system with no access to your lead data. If you ask for support, you can grant time-limited, audited access.
Can I export or delete everything?
Yes. Export all your data at any time. When you leave, you get an export and then a deletion with a certificate after the retention window.
How do I report a security issue?
Email hello@propzolo.com with the details. We acknowledge reports promptly and keep you informed while we fix them.