Trust & Security
Trust & Security
ZoraMatch sits between you and your future customers. That only works if you can trust it completely. This page explains — in plain language — how we handle your data, your leads, and your position in the market.
01 · The data wall
Your leads are yours alone
When a buyer reaches you through your widget or your screening link, that lead belongs to you. Concretely:
- It is never shown in marketplace search results.
- It is never visible to any other supplier — including your competitors.
- It never enters the matching pool or influences anyone's ranking.
- It is enforced at two layers: database row-level security and application checks. Even a bug in the interface cannot leak a lead across the wall.
This is a promise we build the product around, not a policy we could quietly change.
02 · Infrastructure
Where your data lives
- Database and files: Supabase, Frankfurt (EU).
- Hosting: Vercel, EU regions.
- Analytics: EU-hosted, cookie-light (aggregate product analytics; no ad-tech).
- Email: transactional only — lead notifications, account email. Unsubscribe works.
- We do not sell data. We do not share data with third parties for marketing. Ever.
03 · GDPR / AVG
GDPR / AVG
- We operate under the GDPR (in the Netherlands: AVG).
- Screening conversations collect only what is needed to produce your report: company, contact, product need, volumes, certifications, timelines.
- Buyers and leads can act as guests; guest access runs on signed, expiring, revocable links.
- Retention is limited and published in the privacy policy; waitlist data is deleted after 90 days of inactivity.
- Data-subject requests (access, correction, deletion) go through contact@zoramatch.com and are handled within the statutory deadlines.
- AI providers process conversation text to run the interview and write the report. Which providers, and under which safeguards, is listed in the privacy policy.
04 · Screening
Screening transparency: how the score works
Every lead report shows a fit score. In plain language, it weighs:
- how well the request matches your sectors and product categories,
- whether required certifications line up with yours,
- whether the volume fits your capacity and minimum order quantity,
- how complete and consistent the buyer's answers were.
The score is decision support, not a verdict — you always see the full report and decide yourself. Every AI-generated report is logged with the exact prompt and model version that produced it, so a report can always be explained and reproduced. When the data is not sufficient for a conclusion, the report says "not enough data yet" instead of guessing.
05 · Fair ranking
Fair ranking (marketplace)
Published under the EU Platform-to-Business Regulation: matching runs hard filters first (sector, certifications, country, capacity, MOQ), then text relevance, then an AI re-ranking with a written reason per result. Ranking cannot be bought. The Verified badge is earned through identity and quality checks — never purchased.
Full explanation: how ranking works →06 · Security
Security practices
- All traffic encrypted in transit (HTTPS everywhere).
- Row-level security on every table that holds personal data; every query scoped to the owning organization.
- Access to production systems limited to named individuals, with MFA.
- Secrets never stored in source code.
- Error monitoring without personal data in the logs.
- Rate limiting and abuse protection on all public endpoints; email verification and KvK/VAT checks against fake accounts.
07 · Contact
Something wrong?
Found a vulnerability, or believe your ranking or data was mishandled? Email contact@zoramatch.com — security reports get priority handling. Formal complaints run through the published complaint procedure.
Built to be trusted.
EU-hosted, GDPR-native, with a data wall around every supplier's leads. Put it to work today.
Free during early access · EU-hosted · no credit card
