A chamber holds business contact details, payment records, and years of relationship history. This page says plainly how that data is protected — including the things we haven't done yet.
Permissions are not a bullet on a feature list. Every staff account carries a role, and the server checks it on every request — a committee volunteer can run their programme without ever seeing member financials.
Controls are table stakes. These are the policy choices behind them.
You own every record you put into Chamberzu. You can export all of it at any time, in open formats, without asking us. We do not sell member data, and we do not use your members' information to market to them.
Cancel and we delete your data within 90 days, backups included, unless you ask us to remove it sooner. We will send you a full export first.
Access to production data is limited to the engineers who need it, requires multi-factor authentication, and is logged. Support staff work from the fewest privileges that resolve your ticket.
We use a short list of infrastructure and service providers — principally AWS for hosting, Stripe for payments, and SendGrid for transactional email. Each is contractually bound to protect data processed on our behalf, and we will provide the current list on request.
We maintain a documented incident response process. If a breach affects your chamber's data, we will notify you directly with what happened, what was affected, and what we are doing about it — not a status page footnote.
Found a vulnerability? Email us and we will acknowledge within two business days. We do not pursue legal action against researchers who report in good faith and give us reasonable time to fix the issue.
Vendors rarely publish this list. We think a security page that only contains good news isn't a security page.
Need a full security questionnaire completed? Email hello@chamberzu.com and we'll turn it around.
In the United States, on AWS infrastructure. If your chamber has a specific residency requirement, talk to us before you sign anything.
Not yet. We are building to SOC 2 controls and intend to complete a Type II audit, but we will not claim a certification we do not hold. We are happy to complete a security questionnaire in the meantime.
We will sign a data processing agreement. We do not handle protected health information, so a BAA is not applicable to how chambers use Chamberzu.
Only engineers with a specific operational need, using multi-factor authenticated, logged access. Support cannot browse your members casually, and nobody is reading your data for analytics.
You can export everything at any time, so you are never dependent on us being reachable. We would give customers notice and a full export well ahead of any wind-down.
Yes. Roles cover membership, events, finance, and read-only access, so a committee volunteer can run their program without seeing member financials.
Email security reports to our team and we'll acknowledge within two business days. We don't pursue researchers who report in good faith.
Reports go to a human, not a ticket queue. Please give us reasonable time to fix an issue before disclosing it.