Securing your data

Whenever data moves between your device and Foodzilla, it's encrypted in transit with TLS (HTTPS and secure WebSockets), and our setup has an A+ grade from Qualys SSL Labs. Your data is also encrypted at rest when it's stored on disk, and it's backed up every day.

Your data is stored safely in the cloud. Only you, the people you share it with (your team and your clients), and the Foodzilla staff who need it to run and support the service can get to it.

Let's make this clear. We look after your data, but we don't own it. Your practice's data belongs to you, and your clients' information belongs to them. For client information, you decide how it's used and we follow your instructions.

If you decide to go elsewhere, you can export your data first. After you cancel, we keep your account inactive in case you come back, and we don't use the data for anything else. We delete it automatically 7 years after your last activity, or 10 years if your practice is in New Zealand, and we email you 30 days before. You can also ask us to delete it sooner.

Foodzilla is monitored 24 hours a day, 7 days a week, 365 days a year. Our automated anomaly detection has the ability to detect suspicious activity and lock the account in real-time. It can also detect spam and abuse at the signup stage and block bad actors at the gate.

We never see or store your password. Sign-in is handled by our identity provider, Ory, which keeps passwords as one-way hashes that nobody can read, including us. If Foodzilla's own servers were ever compromised, your password wouldn't be there to take.

We offer bug bounties for new, responsibly disclosed issues. If you've found something, please contact us at support@foodzilla.io.

Before a client first uses the Foodzilla app, the client portal or one of your forms, we show them a privacy notice and record their agreement for you. We keep a record of each agreement, which helps you show how your clients' data is collected and shared.

Clients can read the notice again and withdraw their agreement at any time in the Privacy and consent section of their account. They can also ask you to see, correct or delete their information. If they ask us, we pass the request to you, because you're responsible for their record.

Your data is hosted in Singapore. Client records, meal plans, food diaries, messages and health data are stored in a MongoDB Atlas database in the Asia Pacific (Singapore) region, encrypted in transit and at rest. We follow the Australian Privacy Principles, the New Zealand Privacy Act 2020 and the Health Information Privacy Code 2020 for the data we hold, and for UK and European customers we rely on Standard Contractual Clauses together with the UK International Data Transfer Addendum. More data centres are coming soon for our international customers.