Our own systems run in one AWS region, and the edge refuses traffic before the application sees it.

• AWS eu-central-1, Frankfurt: containers, a managed PostgreSQL database and object storage.
• Web application firewall rules at the public edge and again at the load balancer.
• AWS threat detection (GuardDuty) switched on for the region.
• Model, speech and carrier vendors process outside the EU, including the US. That is named per vendor on the sub-processors page rather than glossed here.

In transit everywhere, at rest on every store, and your vendor credentials sealed separately from the rest.

• HTTPS only, TLS 1.3 or 1.2 at the load balancer, HSTS on the console.
• Database encrypted with an AWS-managed key, backups included.
• Recordings stored with AES-256 server-side encryption, in storage that blocks public access and refuses connections without TLS.
• Vendor credentials you give us are sealed with AES-256-GCM before they are stored.
• Platform secrets live in AWS Secrets Manager, not in code.

Our own front door, with a second factor your workspace can insist on and sessions you can end from anywhere.

• Email and password, with passwords stored only as scrypt hashes. Sign-in attempts are rate limited.
• Time-based one-time-password (TOTP) second factor, and a workspace option that requires it of everyone.
• Revocable sessions that end after 8 hours idle and 7 days at the most.
• API keys and invitation tokens are stored only as SHA-256 hashes — we cannot show you a key again after it is issued, because we do not have it.

Four roles over one server-side matrix, and per-agent scopes that can only ever narrow what a role already allows.

• Owner, admin, member and viewer. All 52 gated actions resolve against a single capability matrix on the server; the interface hides what a role cannot do, and the server refuses it regardless.
• Per-agent scopes restrict a member to named agents. They subtract, never add.
• Listening to a recording needs member or above. Exports and erasure need admin.
• Recordings are streamed through the platform after checks on session, workspace and role. They are never available at a public or pre-signed link.

An append-only trail per workspace, hash-chained so a row cannot be edited, removed or re-ordered without breaking the chain.

• It records sign-ins and failed sign-ins, second-factor changes, member and role changes, recordings played, transcripts opened, exports, erasures and scheduled deletions.
• It can be exported, verified, and streamed to your own security tooling as a signed feed.
• AWS CloudTrail records account activity in every region, with log-file validation.
• Application logs are kept 14 days and are scrubbed on the way out: an error prints a name, a code and a short sentence rather than the query, the URL or the transcript that caused it.

Redaction happens on the way in, on all five paths that write conversation content — not as a view over data already stored.

• Ten classes are recognised and eight are on by default: card numbers, IBANs, national ID numbers, CVV codes, PINs, bank account numbers, email addresses and long digit strings, keeping the last four digits.
• Phone numbers and dates of birth can be added per workspace.
• Card and national-ID candidates are checked against their own check digits before they are treated as one, so an order number is not mangled into a redaction.

The limits that matter on a phone line are enforced before the agent speaks and before a number is dialled, not asked for in a prompt.

• A check before the agent speaks enforces your never-say list and stops it reading back card numbers, CVV codes, PINs, bank or IBAN numbers and national ID numbers.
• Outbound calls are checked against a destination policy that refuses when in doubt, and calling hours are resolved from the destination rather than from your clock.
• Opt-out lists are checked before dialling and before a template message, and a STOP reply is recorded against the number that received it.
• Spend ceilings and rate limits refuse rather than overspend when they cannot be checked.

Two windows per workspace and a per-person erasure that reaches every table a person can appear in.

• Recordings and transcripts have separate windows — anything from 1 day to 10 years, 90 days by default — and deletion is scheduled rather than manual.
• Deletions leave a hashed receipt, so a window can be proven to have run without keeping what it deleted.
• Erasing one person reaches 24 kinds of record: conversations, transcripts, scorecards, escalations, scheduled calls, orders, consent records and every other table a person can appear in.
• Opt-out records survive erasure on purpose: forgetting that somebody asked not to be called is how they get called again.

Backups you can restore from, and a call that keeps going when a vendor stops.

• Automated database backups with point-in-time recovery, kept 14 days, encrypted, in the same region. Deletion protection is on.
• A live call can fail over to another vendor for speech-to-text, the model, or text-to-speech, mid-sentence.