Security, compliance & data residency
We run our own SBC, PBX, and voice-AI infrastructure and list the sub-processors we rely on. Here's exactly what protects your calls, messages, and data, and which standards we hold today.
Customer trust comes first
Protecting your data isn't a bolt-on — it's the foundation. Because we run our own SBC, PBX, and voice-AI infrastructure, and list the providers we rely on in our privacy policy, we can be precise about what protects you. Everything below is backed by what we actually ship — no badges we don't hold.
Compliance & standards
We build to — and, where a program is in progress or an offering rather than a held certification, we say so plainly — the following standards and frameworks:
STIR/SHAKEN
STIR/SHAKEN caller ID authentication enforced at the carrier level via our upstream provider. All outbound calls carry the appropriate attestation level.
Licensed Carrier
Operated as a licensed telecommunications carrier — CRTC-registered in Canada and FCC-compliant in the US.
10DLC Registered
US A2P 10DLC brand and campaign registration for compliant application-to-person business messaging, handled with our messaging carrier.
CASL Compliant
Canada's Anti-Spam Legislation honored end-to-end: express-consent gating and bilingual STOP/ARRÊT opt-out enforced on messaging campaigns.
PIPEDA Compliant
Compliant with Canada's federal privacy law (PIPEDA) — including self-serve export and deletion of personal information.
CCPA/CPRA
Consumer privacy rights honored for California residents — right to know, delete, correct, and opt out of sale.
GDPR — DPA Available
Data Processing Agreement (DPA) and data-residency options available for European customers and partners; right-to-erasure and data portability supported.
Encryption & call security
Web, app and API traffic is encrypted with TLS. Pulse app calls are encrypted between the app and our network. Recordings are encrypted at rest.
TLS 1.3 in transit and AES-256 (native storage-level encryption) at rest for databases and media.
DTLS-SRTP encrypted media for WebRTC calls between the Pulse app and our media relay.
STIR/SHAKEN caller-ID attestation on outbound calls, enforced at the carrier level.
E911 with §506(b) (RAY BAUM’s Act) dispatch notifications to a configured contact.
Data residency & sovereignty
Media — voicemails, call recordings, and generated audio — is stored in the region of your billing entity: in Canada if you're billed in Canadian dollars, in the US if you're billed in US dollars. Calls are handled by regional SIP clusters, and the data flows that cross the Canada–US border are listed in our privacy policy. We honor Canada's federal privacy law (PIPEDA) and anti-spam legislation (CASL), US A2P 10DLC registration for business messaging, and offer a Data Processing Agreement for customers and partners with European data-residency needs.
Native AI
Our voice AI — speech recognition, transcription, text-to-speech, and the voice agent's language model — is native to the platform and runs on self-hosted infrastructure in Canada. Two exceptions are disclosed in our privacy policy: SARA's replies to support email, portal chat, and SMS use a US-based third-party AI inference provider, and optional text-to-speech voices from two US providers are used only if you enable them.
Your data & privacy rights
You stay in control of personal data on the platform.
Self-serve data export and deletion of personal information (PIPEDA / GDPR Art. 17).
Account data deleted or anonymized within 90 days after cancellation; billing and call-detail records kept 7 years after fiscal year-end.
CASL express-consent gating and bilingual STOP/ARRÊT opt-out on messaging campaigns.
CCPA/CPRA consumer rights — know, delete, correct, and opt out of sale.
Reliability & status
Our infrastructure runs with built-in redundancy, encrypted backups, and continuous uptime monitoring. Our uptime commitments and service-credit terms are published, and current platform health is live and public — no sign-in required.