Trust & Security
Trust & Security
ZoraMatch sits between you and your future customers. That only works if you can trust it completely. This page explains, in plain language, how we handle your data, your leads, and your position in the market.
01 · The data wall
Your leads are yours alone
When a buyer reaches you through your widget or your screening link, that lead belongs to you. Concretely:
- It is never shown in marketplace search results.
- It is never visible to any other supplier, including your competitors.
- It never enters the matching pool or influences anyone's ranking.
- It is enforced at two layers: database row-level security and application checks. Even a bug in the interface cannot leak a lead across the wall.
This is a promise we build the product around, not a policy we could quietly change.
02 · Infrastructure
Where your data lives
- Database and files: Supabase, Frankfurt (EU).
- Hosting: Vercel, EU regions.
- Analytics: cookieless and aggregate, measured by our hosting provider (no ad-tech, no cross-site tracking).
- Email: transactional only (lead notifications, account email). Unsubscribe works.
- We do not sell data. We do not share data with third parties for marketing. Ever.
03 · GDPR / AVG
GDPR / AVG
- We operate under the GDPR (in the Netherlands: AVG).
- Screening conversations collect only what is needed to produce your report: company, contact, product need, volumes, certifications, timelines.
- Buyers and leads can act as guests; guest access runs on signed, expiring, revocable links.
- Retention is limited and published in the privacy policy; waitlist data is deleted after 90 days of inactivity.
- Data-subject requests (access, correction, deletion) go through contact@zoramatch.com and are handled within the statutory deadlines.
- AI providers process conversation text to run the interview and write the report. Which providers, and under which safeguards, is listed in the privacy policy.
04 · Screening
Screening transparency: how the score works
Every lead report shows a fit score. In plain language, it weighs:
- how well the request matches your sectors and product categories,
- whether required certifications line up with yours,
- whether the volume fits your capacity and minimum order quantity,
- how complete and consistent the buyer's answers were.
The score is decision support, not a verdict. You always see the full report and decide yourself. Every AI-generated report is logged with the exact prompt and model version that produced it, so a report can always be explained and reproduced. When the data is not sufficient for a conclusion, the report says "not enough data yet" instead of guessing.
05 · Fair ranking
Fair ranking (marketplace)
Published under the EU Platform-to-Business Regulation: matching runs hard filters first (sector, certifications, country, capacity, MOQ), then text relevance, then an AI re-ranking with a written reason per result. Ranking cannot be bought. The Verified badge is earned through identity and quality checks, never purchased.
Full explanation: how ranking works →06 · Security
Security practices
- All traffic encrypted in transit (HTTPS everywhere).
- Row-level security on every table that holds personal data; every query scoped to the owning organization.
- Access to production systems limited to named individuals, with MFA.
- Secrets never stored in source code.
- Error monitoring without personal data in the logs.
- Rate limiting and abuse protection on all public endpoints; email verification and KvK/VAT checks against fake accounts.
07 · Contact
Something wrong?
Found a vulnerability, or believe your ranking or data was mishandled? Email contact@zoramatch.com. Security reports get priority handling. Formal complaints run through the published complaint procedure.
Built to be trusted.
EU-hosted, GDPR-native, with a data wall around every supplier's leads. Put it to work today.
Free during early access · EU-hosted · no credit card
