Security, privacy and compliance

Certified for the industries that ask hard questions.

Insurance and banking organizations do not accept a trust page as evidence. We hold ISO/IEC 27001 Information Security certification and SOC 2 Type I and II attestations.

ISO/IEC 27001 certified

An audited information security management system covering our delivery hubs, corporate environment and client operations.

With the risk register, control set and internal audit cycle behind it.

SOC 2 Type I attested — Type II in progress

Independent examination of security, availability and confidentiality controls over an operating period.

Evidence that the controls work, not just that they exist.

Material controls

Customer conversations and transcripts are the most sensitive data

A recorded call can contain sensitive information. Our controls are built around that reality.

PII detection and redaction

Card numbers, IDs and other sensitive information can be masked in transcripts and muted in recordings, at your request.

PII detection and redaction

Card numbers, IDs and other sensitive information can be masked in transcripts and muted in recordings, at your request.

PCI-aware call handling

Recording pause and resume around payment capture; card data routed to tokenized entry rather than through the agent.

PCI-aware call handling

Recording pause and resume around payment capture; card data routed to tokenized entry rather than through the agent.

Encryption in transit and at rest

TLS 1.2+ and SRTP on media, AES-256 at rest, key management separated from application access.

Encryption in transit and at rest

TLS 1.2+ and SRTP on media, AES-256 at rest, key management separated from application access.

Configurable retention

Retention windows and residency set per client and per data class, with verified deletion on request.

Configurable retention

Retention windows and residency set per client and per data class, with verified deletion on request.

Least-privilege access

Role-based access, SSO and MFA.

Least-privilege access

Role-based access, SSO and MFA.

Model and data boundaries

Your conversation data is not used to train shared models. Grounding data stays scoped to your tenant.

Model and data boundaries

Your conversation data is not used to train shared models. Grounding data stays scoped to your tenant.

Working with your risk team

We have been through the questionnaire before.

Vendor security reviews, penetration test summaries, DPAs and BAAs, evidence for your auditors.

Talk to us under NDA

Regulatory alignment

Programs run against GLBA, HIPAA, TCPA, FDCPA and GDPR requirements as the engagement demands, with the disclosures written into the conversation flow.

Business continuity

Two geographically separate delivery hubs, tested failover for voice routing, and documented recovery objectives.

Incident response

Defined severity levels, named contacts, and notification timelines committed to in contract.

Get Started

Send us your security questionnaire.

We will return it completed, with the ISO certificate and SOC 2 report attached under NDA.

Talk to Sales