Gallabox vs Zaapi (2026)

Connectors cover CRM with HubSpot, Zoho, Salesforce, Pipedrive, LeadSquared, Kylas, Odoo and Sangam, commerce with Shopify, WooCommerce and Shopflo, payments with Razorpay, Stripe and Cashfree, logistics with Shiprocket and Shipway, and marketing with CleverTap, MoEngage, WebEngage, Fyno and Facebook Leads, along with Calendly, Zoho Books, Google Sheets, MiiTel, Pabbly, Zapier and generic webhooks.

They work in both directions: CRM push and pull nodes move records both ways, a Zoho lead panel renders CRM data inside the conversation, and payment integrations take money inside WhatsApp through catalog and checkout. On top sits the apiCall agent action, which issues HTTP requests of any standard method, from GET to DELETE, to any endpoint with operator-supplied headers and body and feeds the response back into the conversation. The agent invokes it when the condition the operator wrote is met, with a configurable fallback when the call fails, and actions chain in sequence.

Sourcegallabox.com docs Integrations overview, Connectors and Agent Actions pages; docs.gallabox.com/integrations/overviewread 2026-09-05

The unified inbox connects WhatsApp, Facebook, Instagram, TikTok, LINE, Shopee, Lazada, a website chat widget, Outlook and Gmail, with Shopify and HubSpot as integrations from Pro upward. That covers messaging, marketplace, commerce and CRM systems. The agent writes as well as reads. It creates orders during conversations, and marketplace review automation posts replies back to Shopee and Lazada.

Shopify native flow triggers fire on checkout abandoned and order placed. On Advanced, webhook and HTTP actions let a flow call any external endpoint and carry on with the response. Marketplace order and customer data is pulled into the conversation for context. No connector count is published, and the integrations list stops at the named set.

Sourcezaapi.com integrations, pricing feature comparison and sales use-case pagesread 2026-09-05

Two orchestration models run side by side. The rule-based Flow Builder is a canvas where nodes are arranged, a trigger set, and the flow tested and then published live. Its nodes come in four kinds, send, ask, action and flow-control nodes, and the flow-control nodes form the logic layer that branches conversations, adds delays, calls external APIs and routes into other flows through a Jump Flow node. Condition and branching depth is tiered, from basic through advanced to full custom.

The agent path orchestrates by instruction instead, chaining actions in sequence, so in one example the agent fetches an order through apiCall and then hands the conversation to a fulfillment team, with a fallback response configured for a failed call. Around both sit assignment rules, round-robin routing within teams, drip sequences with triggers, delays and conditional steps, and Smart Retry on broadcasts.

Sourcegallabox.com docs Flow Builder, Flow Control Nodes, Agent Actions and Sequences pages; docs.gallabox.com/ai-agents-and-bots/bots/flow-builderread 2026-09-05

Flows run several steps, branch and call outside systems, and events start them as well as messages. The Flow Builder is a no code, drag and drop canvas. From Pro up it offers advanced triggers, conditions and actions for more flexible flows. On Advanced it adds webhook and HTTP actions, so a flow can branch on a condition and call an outside endpoint mid run.

Entry points include marketplace state changes, Shopify checkout and order events and inbound webhooks. Flows mix participants. Merchants design journeys that route chats to the right agents for refunds or technical support, group and tag customers, and hand off between AI chatbots and human agents. Marketplace review automation runs as its own configured sequence. Zaapi names no runtime and does not describe retry or failure handling.

Sourcezaapi.com pricing feature comparison and AI chatbot builder guideread 2026-09-05

Text channels are WhatsApp on the official Business API, Instagram DMs with public comment automation driven by configured intents, and a Web Chat widget that Gallabox controls outright, so no 24-hour messaging window applies. Voice covers human WhatsApp calling inbound and outbound with routing to the right agents, AI voice agents answering inbound WhatsApp calls, and AI voice on phone lines where the customer connects its own telephony provider.

Inbound triggers include Click-to-WhatsApp ads with conversion signals returned to Meta through the Conversions API, QR codes, chat links, a website click-to-chat button and the embedded widget. Outbound, broadcasts reach segmented audiences from ten thousand contacts a month to unlimited by tier, and drip sequences fire on a trigger and step through delays and conditions. Business hours, special days and holiday configuration bound when agents run, and agents carry per-channel greetings, instructions and availability.

Sourcegallabox.com docs Compare Channels, WhatsApp Calling, Broadcasts, Sequences and Comment Automation pages; docs.gallabox.com/concepts/channelsread 2026-09-05

Marketplace triggers fire on review received, order created, shipped, delayed, delivered, failed, canceled and returned or refunded. Shopify native flow triggers add checkout abandoned and order placed. Webhook event triggers let any external system start a flow. Broadcasts carry smart scheduling, so work can also start on a schedule.

The events are changes in commerce state, not message arrivals, so work reaches the agent when something happens in the merchant's business. Each channel is a separate inbound stream, covering WhatsApp, Facebook, Instagram, TikTok, LINE, Shopee, Lazada, a website chat widget, and Outlook and Gmail.

Sourcezaapi.com pricing feature comparison, Automations and Unified inbox sectionsread 2026-09-05

The Knowledge Base works as a RAG system, where the agent searches it when a visitor asks, retrieves the most relevant chunks, includes them in the prompt and answers from the customer's own documents. Vector storage runs on a managed Qdrant provider or against the customer's own OpenAI Assistant vector store.

Chunking is configurable, defaulting to 800 tokens with 400 tokens of overlap, and retrieval is configurable, defaulting to two documents per query at a relevance threshold of 0.7, with hybrid semantic plus keyword search and reranking enabled by default. Sources ingest as PDF, Word, CSV, Excel, text, Markdown and JSON, plus URL crawling. Documents show a Pending, Processing or Completed indexing state and can be re-indexed individually without rebuilding the base, and an agent can hold up to three Knowledge Bases. Knowledge base size is gated by tier, 10 MB on Essential and 100 MB on Advanced, with DOC and PDF on Essential widening to URL, PDF and DOC on Advanced.

Sourcegallabox.com docs Knowledge Base overview and add data sources pages; docs.gallabox.com/ai-agents-and-bots/chat-ai-agent/knowledge-base/overviewread 2026-09-05

Merchants train the AI by uploading knowledge sources, a feature on every plan. Sellers can upload documents or add links for the AI to reference. The Enterprise tier raises knowledge base limits, so the store is sized and persists instead of being gathered per conversation. Underneath, Voyage AI handles embeddings and message processing and Unstructured Technologies handles document parsing, which together form an ingestion and embedding pipeline. The knowledge base persists, with size limits by tier, fed by parsed documents and crawled links and queried through embeddings.

Sourcezaapi.com sub-processors and pricing pages, zaapi.com AI chatbot builder guideread 2026-09-05

Within a session the Chat AI Agent holds full conversational context across multiple turns, whereas bot flows carry single-turn context and AI Reply a single message.

Outside the session, contact fields, conversation fields, tags and dynamic segments persist against the customer record indefinitely, and an escalated conversation hands a person the full history.

There is no memory product, and Gallabox does not say what an agent retains between separate conversations with the same contact, for how long, at what scope, or how an operator inspects or deletes it. The session is the unit throughout the analytics surface.

Sourcegallabox.com docs Chat AI Agent overview, Contacts and Segments pages; docs.gallabox.com/ai-agents-and-bots/chat-ai-agent/overviewread 2026-09-05

Customer details are available on every plan inside the unified inbox, and labels and saved filters carry across conversations. Marketplace order and purchase data are pulled into the thread for context, and full message history is exportable on Advanced. A lightweight CRM consolidates chat history and purchase data into one view.

An agent, human or AI, sees who it is dealing with and what they bought. Zaapi does not say what the AI keeps between separate conversations with the same shopper, at what scope or for how long. It names no way for an operator to inspect or clear what the AI holds, or to delete it for one customer.

Sourcezaapi.com pricing feature comparison, Unified inbox sectionread 2026-09-05

The operator writes the agent's Role, Goal and Instructions, stating topics to refuse, tone rules, escalation conditions and how to handle off-topic questions, so behavior is bounded by a policy the customer writes. Agent Actions limit what the agent can do, and Gallabox's answer to a wrong or harmful answer is to restrict the agent through Actions, which are individually gated and invoked only on conditions the operator specifies. AI Reply is a separate mode in which the AI drafts and a person reviews and sends, so every message can be approved before it goes out.

Escalation through assignTo and assignmentRule routes to a named user, team or bot, and the conversation lands in the Omnichannel Inbox carrying full history, captured customer details, the agent's stated reason for escalating and its notes. Availability hours and an agent active or inactive toggle bound when it runs at all. Web Chat has no Inbox for a live session, so assignTo and assignmentRule do not work there and the only escalation path is redirecting the visitor to WhatsApp.

Sourcegallabox.com docs Agent Actions, Chat AI Agent overview and AI Reply pages; docs.gallabox.com/ai-agents-and-bots/chat-ai-agent/agent-actionsread 2026-09-05

The AI clears first contact chats and hands off to a person when it cannot resolve them. The Flow Builder routes conversations to the right agents by topic, with refunds and technical support as Zaapi's own examples, alongside auto assignment, labeling and agent availability. Basic automations include greeting and out of hours messages that limit when the AI answers at all. The AI testing environment lets an operator see behavior before it reaches customers.

The AI deployment step is an explicit act of enabling the AI to respond to real customers, so switching it on is a deliberate decision, not a default. Zaapi names no review and approve surface, pre send queue, draft review mode, confidence threshold or per message approval. Once deployed, the AI replies to customers directly. People step in by taking over after a handoff, not by signing off before a reply is sent.

Sourcezaapi.com pricing feature comparison and AI chatbot builder guideread 2026-09-05

Customers control who inside their organization can do what, with multi-factor authentication enforced for all users, role-based access control that is team-based and channel-based, and custom roles carrying per-module permissions such as the developer permission governing webhooks and API keys, alongside phone and number masking, IP whitelisting restricting workspace access, and SSO and SAML on the Enterprise tier.

Security controls also include AES-256 at rest and TLS 1.2 or 1.3 in transit, a cloud web application firewall, SIEM logging, endpoint detection, periodic penetration testing, and PII-permission masking on webhook payload views. The pricing page says Gallabox is SOC 2 Type II compliant and the footer carries an AICPA SOC mark, while the documentation security page says the company is in the process of becoming SOC 2 and GDPR compliant, and no trust center, report request path or auditor letter is published.

Sourcegallabox.com docs Data Security, Two Factor Authentication and Users, Teams and Roles pages, gallabox.com pricing and footer; docs.gallabox.com/privacy-and-security/data-securityread 2026-09-05

No certification or attestation is claimed, and SOC 2, ISO 27001, GDPR and regional certifications go unmentioned. The Enterprise tier is set apart by custom reports, a dedicated account manager, increased knowledge base limits and a flow builder consultation. Its description names enterprise security as a phrase with nothing behind it.

Seats exist and conversations can be assigned to agents, but Zaapi publishes no role model, permission set, SSO or SAML, so there is no account of who inside a merchant's organization can do what. Okta Auth0 handles user authentication for Zaapi's own login, and it is not an identity integration offered to the customer. Zaapi does publish a complete, dated sub-processor register naming nineteen processors with locations, along with a privacy policy, terms of use and a public status page. It has no trust center or security page on any subdomain.

Sourcezaapi.com sub-processors, pricing and footerread 2026-09-05

Every agent session appears as a row in a sessions table, and opening one shows a detail drawer with the full Chat Log, the session ID, channel, contact, created date, session status with a drop reason where it applies, the AI credits the run consumed and the model that answered, so a specific reply can be attributed to a specific model and cost after the fact.

Sessions export to Excel with an export history, and a Conversation.AI.Analyze webhook pushes completed analyses into a system the customer already runs. Underneath sit an Activity Log of data interactions, audit trails the security page calls exhaustive, and conversation, broadcast, sequence, bot and template analytics. The same Analyze tab carries outcome evaluation and a Successful sessions metric, and the Agent Analyze surface sits on the Advanced tier.

Sourcegallabox.com docs AI Agent Analytics, Webhooks and Data Security pages; docs.gallabox.com/ai-agents-and-bots/chat-ai-agent/ai-agent-analyticsread 2026-09-05

Analytics are tiered. From Pro upward they cover conversation performance, agent performance, sales performance, label usage and raw data export. Broadcast performance data comes on every plan, and Advanced adds export of full message history. A merchant can measure resolution times, team output, revenue attributed to chat and where volume is concentrating.

Zaapi names no way to inspect an individual AI run, such as which uploaded knowledge source grounded a reply, which flow branch ran, which HTTP action fired or why the agent answered as it did. Zaapi's own engineering stack uses LangSmith for AI observability and tracing, SigNoz for observability and logging and Sentry for error monitoring. Tracing of each run therefore exists inside Zaapi, but Zaapi does not say whether customers can see it.

Sourcezaapi.com pricing feature comparison and sub-processors pagesread 2026-09-05

Gallabox's subprocessor table names seventeen processors and places every one in the United States, including AWS for storage and CDN, MongoDB for the database, Vercel and Heroku for hosting, and Redis and ClickHouse for infrastructure, and backups span multiple zones with a primary data center in the US.

For a vendor headquartered in India selling into Indian and Gulf support teams, that means the data leaves the region, and customers cannot choose where it sits. The Enterprise tier lists on-prem or private cloud and data residency as a pricing-page bullet, naming no region, mechanism or configuration surface, and the documentation describes neither.

Sourcegallabox.com docs Subprocessors and Data Security pages, gallabox.com pricing; docs.gallabox.com/privacy-and-security/subprocessorsread 2026-09-05

Cloud hosting and storage run on Amazon Web Services in Singapore, and database services on MongoDB Atlas in Singapore. AI model services are split across the United States and Singapore through Google and Microsoft, and the model providers Anthropic and OpenAI sit in the United States.

A customer can see exactly where data goes, which matters for a seller base in Southeast Asia. The arrangement is fixed. There is no region selector, VPC, single tenant, on premises or customer tenant option. The Enterprise tier adds custom reports, a dedicated account manager and increased knowledge base limits, not deployment choices.

Sourcezaapi.com sub-processors and pricing pagesread 2026-09-05

The chatbot template library can be filtered by eight industries (ecommerce, healthcare, automobile, education, travel, real estate, finance and a popular set) and by seven use cases covering lead generation, booking and scheduling, sales, support FAQ, product recommendation, surveys and discovery.

Each template has its own URL, description, live Try action and usage count, among them a Lead Validation Bot, an emergency ambulance booking bot, a medical records retrieval bot, a membership booking bot and a vehicle rental recommendation bot.

Inside the product, the Chat AI Agent creation wizard asks for an industry and then a use case such as Lead Qualification, Sales, FAQ or Receptionist, and generates the agent's role, goal and instructions from that starting point.

Sourcegallabox.com chatbot templates library and docs Chat AI Agent overviewread 2026-09-05

Merchants build their own agent and flows. The product ships one AI Agent that a merchant trains, tests and deploys, plus a Flow Builder in which they compose their own journeys. Zaapi's guide walks a seller through building a chatbot from scratch, setting response triggers by keyword or button and routing chats to the right agents.

Some ready made behaviors come with it, including greeting messages, out of hours responses, conversation closing messages, marketplace review automation and Shopify checkout abandoned flows, so a merchant does not start from nothing. There is no template gallery, flow library, named prebuilt agent set or entitlement for a customer to browse and adopt. Instead Zaapi offers services. Under its AI Success Kit, Zaapi builds the AI for the merchant across their channels, and Enterprise includes a flow builder consultation.

Sourcezaapi.com pricing, AI chatbot builder guide and AI services pagesread 2026-09-05

Each Chat AI Agent has an AI Model Settings section whose Model field lists the models enabled for the account's AI wallet, with the catalog naming the GPT-4o, 4.1 and 5 family, grok-4.3, Gemini 2.5 Pro and Flash, DeepSeek, Kimi and Qwen. Alongside the model the operator sets LLM Temperature from 0 to 2, defaulting to 0.1, and a Thinking Level of None, Low, Medium or High on reasoning-capable models.

Two provider versions exist, v2 defaulting to grok-4.3 and legacy v1 defaulting to gpt-4o-mini, with a one-click migration between them. Credit consumption varies by model at its own per-token rate, and the model used is recorded on each agent session. The v2 agent generation carries this selector, and v1 is deprecated.

Sourcegallabox.com docs Chat AI Agent overview, AI Model Settings and v1-to-v2 migration pages; docs.gallabox.com/ai-agents-and-bots/chat-ai-agent/overviewread 2026-09-05

Four model providers run underneath, and the merchant picks none of them. Google supplies cloud infrastructure and AI model services, including Gemini models. Microsoft hosts AI models through Azure AI Foundry, Anthropic and OpenAI are AI model providers, and Voyage AI handles embeddings and message processing. Zaapi lists all of them in its current and complete sub-processor register.

There is no model selector, routing rule, per agent assignment or bring your own key path. The AI Agent's settings cover knowledge sources, testing and deployment, not models. AI usage is metered as tokens priced per thousand messages, not per model, which fits with Zaapi making the choice.

Sourcezaapi.com sub-processors page, pricing pageread 2026-09-05

The API reference on Gallabox's api-docs subdomain is a Postman collection with request samples in more than twenty languages including cURL, Python, Node, Java, PHP, Go and Ruby, and the API is what a customer calls to query data or take actions in Gallabox, while webhooks push outward. Message and Contact APIs come with Basic and all APIs with higher tiers, with messaging rate limits of 100, 200 and 1,000 messages per minute by tier. Credentials have their own permission, held by custom roles that can view and manage webhooks and API keys.

Outbound, more than twenty-five subscribable events across contact, conversation, message, template and broadcast each carry the event name in an x-event-name header, with a configurable HTTP method, custom headers, an optional shared secret producing a base64 HMAC-SHA256 signature in x-gallabox-signature, automatic retry up to five attempts, and a delivery log holding status and payload for seven days.

Sourcegallabox.com docs Webhooks and pricing pages, api-docs.gallabox.com; docs.gallabox.com/settings/webhooksread 2026-09-05

Webhook event triggers and webhook and HTTP actions come on the Advanced and Enterprise tiers, and Webhook events sit among the integrations beside HubSpot and Shopify. An external system can start a Zaapi flow, and a Zaapi flow can call an external endpoint, both set up in the Flow Builder without code. Zaapi publishes no API or SDK for its own platform, and no developer portal, endpoint reference, authentication model, client library or MCP server. Its help center carries operational articles, not developer documentation.

Sourcezaapi.com pricing feature comparison, Automations and Integrations sectionsread 2026-09-05

The Test Widget is the step before going live, and operators run it before launch and again after configuring actions or connecting a Knowledge Base, while bot flows are tested in the Flow Builder and then published. Outcome evaluations, a named plan feature, score a conversation against the business outcome the operator defined, appear per session in the Analyze tab as a goal outcome, and roll up into a Successful sessions metric that measures whether the agent achieved its intended outcome rather than merely reaching an end state.

Dropped sessions carry a drop reason, and operators read them to find where a flow loses people, change the flow and republish it. Each evaluation deducts AI credits when a conversation is scored against an outcome. Outcome evaluations sit on the Advanced tier and custom evaluation rules on Enterprise, and there is no regression suite, versioned test set or prerelease scoring run against a fixed corpus.

Sourcegallabox.com docs AI Agent Analytics, Chat AI Agent and Flow Builder pages, gallabox.com pricing; docs.gallabox.com/ai-agents-and-bots/chat-ai-agent/ai-agent-analyticsread 2026-09-05

The AI Agent follows a three stage lifecycle on every plan. AI training means uploading knowledge sources. AI testing means trying the AI in a secure environment. AI deployment means enabling the AI to respond to real customers. The testing stage separates a rehearsal environment from live customers, so a merchant tries a change before it reaches anyone.

All three stages are available on Basic, Pro, Advanced and Enterprise. Zaapi advises sellers to test a flow internally and fix any issues before rolling out a chatbot. Zaapi names no scored test set, pass rate, regression suite or published threshold, and no experiment or holdout after deployment.

Sourcezaapi.com pricing feature comparison, AI Agent sectionread 2026-09-05

The route out of the platform is entirely programmatic. Named connectors write into CRM, commerce, payment and logistics systems, the apiCall action issues HTTP requests to any endpoint, bot flows carry an API node and a Google Sheets node, and outbound webhooks push events to systems the customer runs.

The closest capability is codeExecution, which is limited to a sandbox for basic mathematics and string manipulation, not full programming. Gallabox's customer-facing surface is a chat widget it renders, and nothing in the product controls a browser, runs a hosted session or automates an interface.

Sourcegallabox.com docs Agent Actions, Connectors and Flow Control Nodes pages; docs.gallabox.com/ai-agents-and-bots/chat-ai-agent/agent-actionsread 2026-09-05

Every outside system is reached through credentialed channel connections and integrations. They include marketplace APIs for Shopee and Lazada, Meta and TikTok platform connections, LINE and WhatsApp business channels, Shopify and HubSpot integrations, and webhook and HTTP actions for anything else. Zaapi's own surfaces are a chat widget the merchant embeds, a web app and a mobile app.

Marketplace review automation posts replies onto Shopee and Lazada review pages, which Zaapi does not own, but it does so through the marketplace integration and does not navigate an interface. Zaapi names no browser, desktop or remote computer control, and no session or interface automation.

Sourcezaapi.com pricing feature comparison and integrations pagesread 2026-09-05