Security and compliance

In AWS Mumbai (ap-south-1) by default. Primary stored data stays in the selected hosting region; certain real-time AI inference steps may involve controlled, transient processing outside India depending on provider configuration.

Yes. AES-256 at rest and TLS 1.2 or higher in transit. Access is role-based with least privilege, privileged access requires MFA, and access is logged.

Calls are transcribed and summarised, and it is the written transcript that is kept and shown in your dashboard. Personal details are redacted from the stored transcript.

No. Every business is a separate tenant with its own hours, staff, answers, diary and call history. A caller's record belongs to the business they rang, even where the same person has called two of our clients.

It is built to align with the Digital Personal Data Protection Act, 2023. Outbound calling follows TRAI rules: business calls only between 9 AM and 9 PM, promotional calls only with recorded consent, and a do-not-call list honoured before any call is placed.

No. We do not sell or share call data, and we do not use your customers' conversations to train models for anyone else.

You can export your data before deletion. Customer data is deleted from primary systems within 60 days of termination unless the law requires retention, and backups are purged within 90 days on a rolling cycle.

A structured incident-response process covers triage, containment, investigation, remediation and review. Confirmed breaches affecting your data are notified without undue delay, with the nature of the incident, the data affected, the impact window and the steps taken.

Yes. Material sub-processor changes are notified at least 30 days in advance where contractually required, and you may object in writing within 15 days on reasonable data-protection grounds; if it cannot be resolved you may terminate the affected services.