Trust CenterUpdated 16 October 2026
Trust is part of the product. Here’s all of it.
How Zero Human protects your data, your brand and the people in your ads — what’s finished, what’s in progress, and the dates we’re holding ourselves to.
Policies & documents
Every policy, in full.
Each one starts with the short version and ends with the binding detail. Print or save any of them as a PDF for your review.
Legal
The agreements and policies that apply when you use Ori.
Privacy & data
What we collect, how AI uses it, and who helps us.
AI & safety
How Origin is governed, and how Ori keeps ads honest.
Security
How we protect Ori, and where we are on certification.
Compliance
Where we are, with dates.
Ori is in pilot. We’d rather show you an honest roadmap than a wall of badges we haven’t earned yet. Every date here is a commitment, and we update this page when one moves.
Security
How the platform is built and watched.
- Infrastructure
- Production runs on a major cloud provider in isolated accounts, with your workspace data in the region you choose. No customer data on laptops.
- Encryption
- AES-256 at rest and TLS 1.2 or higher in transit. Keys live in a managed key service and are rotated every year.
- Access
- MFA for every employee. Production access is granted just in time, logged, and reviewed every quarter. SSO (SAML 2.0) and SCIM on Enterprise.
- Monitoring
- Centralised logs, kept for a year, with round-the-clock alerts on unusual access.
- Vulnerabilities
- Dependencies are scanned on every build. We fix critical issues within 7 days and high ones within 30.
- Incidents
- A written response plan that we rehearse twice a year. If a breach affects you, you hear from us within 72 hours of confirmation.
- Continuity
- Daily encrypted backups and regular restore tests, with a 24-hour recovery target.
- People
- Background checks where the law allows, security training when people join and every year after, and confidentiality agreements for everyone.
Privacy & data
Your ads, your brand memory, your region.
The short version: we don’t train Origin on your content, your brand memory never leaves your workspace, and your data stays in the region you choose. The long version is the Privacy Policy.
What we collect
Account details, the brand assets you upload, your briefs, the ads Ori makes, and results from the ad accounts you connect.
What we never do
Sell your data, train Origin on your content without written opt-in, or share brand memory between workspaces.
Where it lives
In the US or the GCC — you choose when you sign up. Enterprise workspaces can also choose the EU.
How long we keep it
Until you delete it. When you close your workspace, your data is gone within 30 days, and from backups within 35 days after that.
Connected accounts
Ori gets read-only access by default. Permission to publish is a separate, explicit step that you can revoke at any time.
Your rights
Access, correct, export or delete your data by writing to info@zerohuman.co. Self-serve controls arrive in Settings before general availability.
AI governance
How we decide a model is ready.
Origin, the model behind Ori, is still in development. Every release goes through the same gates, and the results go into the model card.
- 01Evaluations before every releaseQuality, bias across skin tones, ages and dialects, and policy compliance. A release that misses a threshold doesn’t ship.
- 02Red-teaming in Arabic, not just EnglishInternal and external testers try to break the content policy, with extra focus on regional and Arabic-language misuse.
- 03People review what machines flagAny flagged brief or output goes to a trained reviewer, not just another classifier.
- 04An incident registerSafety incidents are logged and reviewed every week, and we publish a summary every quarter.
- 05Documented training dataWe record where training data comes from and leave out anything we don’t have the rights to use.
Content safety
What Ori won’t make.
Some ads shouldn’t exist, however they’re asked for. This is the short list. The full rules are in the Usage Policy.
- Political, election or referendum ads
- Real people without their verified consent
- Anything sexual, or minors in unsafe situations
- Medical, financial or legal claims you can’t back up
- Fake before-and-after results
- Hate, harassment or violence
- Weapons, drugs or gambling where they’re illegal
- Alcohol, tobacco or pork in markets that ban those ads
- Ads for brands you don’t own or represent
- Scams, fake giveaways and deceptive offers
Five checks on every ad
A single filter is easy to get around. So each ad is checked at every stage, in Arabic and English.
- 01The briefChecked against the policy before anything is planned.
- 02The scriptClaims, prices and restricted topics, in both languages.
- 03The framesScanned for people, logos and unsafe content.
- 04The voiceThe transcript is checked too: what’s said, not just shown.
- 05A personAnything flagged waits for a trained reviewer.
Elections & politics
Ori doesn’t make political ads. At all.
No parties, candidates, elections, referendums or campaigns on contested political issues. Public figures are blocked by default, and their voices can’t be cloned. We’d rather lose that business than risk a fake that changes a vote.
Likeness & consent
A real face or voice needs a real yes.
Want your founder, staff or a creator in your ads? That person goes through a consent flow themselves. Uploading someone’s photo isn’t enough.
- Step 1Identity checkThe person verifies with an ID and a short live selfie video.
- Step 2Recorded consentThey say on camera which brand can use their face or voice.
- Step 3Clear scopeWhich brands, which markets and for how long. Nothing wider.
- Step 4RevocableThey can withdraw any time. New ads stop within 24 hours, and we help take live ones down.
Seen yourself in an ad you didn’t agree to? Write to info@zerohuman.co with a link. We take it down first and investigate after.
Provenance
Every ad says where it came from.
One label is easy to strip, so every export carries several layers. If one is lost, the others still hold.
What provenance can’t do. Social platforms often remove metadata when a video is uploaded, and visible marks can be cropped out. That’s why we use layers. Provenance also shows where an ad came from, not whether its claims are true. That job belongs to the content checks above.
Human oversight
You decide how much Ori does alone.
Ask before posting
Ori makes everything and asks before anything goes live. One tap from you, and it’s out.
Suggest only
Ori plans and makes ads, then leaves them in your inbox. You post them yourself.
Post on its own
Ori posts at the best times, within the budget and rules you set.
Whatever the mode, Ori never spends more than the budget you set and never changes a running campaign without asking. Every decision, by a person or by Ori, goes into an audit log you can export.
Subprocessors
Who else touches your data.
During the pilot, we share the named list under NDA. We’ll publish it here at general availability, and we give 30 days’ notice before adding anyone new.
Request documents
Everything your security review needs.
Pick what you need. We reply within two business days, and sooner if your deal is waiting on it.
Report a vulnerability
Found something? Tell us first.
Our promise
- Reply within 1 business day
- Triage within 3 business days
- Critical fixes within 7 days
- Credit, if you’d like it
We won’t take legal action against good-faith research. Please don’t access other customers’ data, degrade the service, or target our staff. Test with your own account.
Legal
The policies, in plain words.
The summaries below are here to help, but the full documents are what bind us. Each one is linked, and you can request signed copies above.
Terms of ServiceUpdated 16 Oct 2026
- You own the ads Ori makes for you, and everything you upload.
- You’re responsible for the claims in your ads and for having the rights to what you upload.
- Paid plans can cancel any time. Access continues to the end of the billing period.
- Ori is in pilot. We’ll tell you before we change anything you rely on.
Privacy PolicyUpdated 16 Oct 2026
- What we collect, why, who we share it with and for how long.
- We don’t sell or share personal data for cross-context advertising, ever.
- Write to info@zerohuman.co to access, correct, export or delete your data.
Usage PolicyUpdated 16 Oct 2026
- The full list of what Ori won’t make, the categories that need extra care, and what you must disclose.
- Repeated attempts lead to suspension.
- Appeals go to a different reviewer, with an answer within 5 business days.
Data Processing AddendumUpdated 16 Oct 2026
- Covers CCPA/CPRA, GDPR, UAE PDPL, Saudi PDPL and Bahrain PDPL.
- Standard contractual clauses for transfers between regions.
- Available on every paid plan. Request it above.
Copyright & IP PolicyUpdated 16 Oct 2026
- How to report an ad that infringes your rights, and how counter-notices work.
- How rights holders can keep their works out of Origin’s training data.