The shortest Data Privacy Act story in call QA
RA 10173 compliance gets hard when voice recordings move. So we built the product so they don't: call audio stays on your premises, full stop. Here is the whole architecture.
Premises Separation & Data Boundaries
Zero Cloud Voice AudioWhat we commit to — in writing
Audio never leaves your premises
Transcription runs on your hardware, inside your network. Our systems never receive, store, or even briefly touch a voice recording. What crosses the wire is text.
Transcripts in, nothing else
The API accepts JSON transcripts only. There is no upload endpoint for audio in production — not disabled, not gated: it does not exist.
Isolated by design
Every row of your data carries your tenant ID, and the data layer scopes every single query to it automatically — an architecture decision, not a convention. Dedicated database, zero cross-tenant contamination.
Deletion is an API call, not a ticket
DELETE a call and its transcript, score, and alerts are gone in the same atomic transaction. Your team can call it any time, no approval loop on our side.
The data agreement comes first
Before a pilot transcript moves, we sign a data agreement with retention limits, deletion rights, and named subprocessors. You keep a copy your DPO will actually like reading.
Consent stays your story — we keep it short
Your notice to customers already covers QA review of recorded calls. Because audio stays with you and only text is processed further, the disclosure you already make keeps covering it.
Questions your DPO will ask anyway
Where does the AI scoring run?
Transcript text is scored via a large-language-model API over TLS 1.3. The scoring provider is a named subprocessor in your data agreement, and your data agreement contractually bars the use of your transcripts for model training.
What happens when a pilot ends?
You call the deletion API — per-call deletion is immediate and self-service. Full-dataset removal is written into the data agreement with a hard deadline (days, not "upon request"), and we confirm completion in writing.
Are you certified?
We're an early-stage product and won't pretend otherwise: no SOC 2 badge yet. What we offer instead is an architecture where the sensitive artifact — the voice recording — never reaches us, a signed data agreement, and full deletion rights. Ask us anything; short answers are a feature.