ConversAI Labs Trust Center
Voice AI agents for Indian enterprisesOur voice agents talk to your customers on your behalf. They hear their voices and handle their phone numbers, bookings and loan details. Keeping that data private, correct and available is part of the product.
This page summarises the controls we have in place. Customers can request our security overview, data processing agreement and full subprocessor list.
Standards
We do not hold a SOC 2 report or ISO 27001 certificate of our own yet. Our infrastructure runs on a cloud provider that holds both.
DPDP Act 2023
We act as Data Processor for our customers (the Data Fiduciaries): processing on their instruction, security safeguards, erasure on request, breach notice.
Data stored in India
Customer data, call recordings and call analytics are stored in data centres in India.
SOC 2 Type I
Controls below are being brought to SOC 2 level first; an audit follows once they have run for a full period.
ISO 27001
After SOC 2. Our cloud provider's own ISO 27001 and SOC 2 reports cover the hosting layer today.
Controls
What protects call data and accounts today. Search by keyword.
Data securityDATA
- Encryption at restIn place
Customer data, recordings and backups are encrypted at rest.
- Private call recordingsIn place
Recordings are never public and play only through short-lived signed links.
- Customer data separationIn place
Each customer can see and change only its own data.
- Sensitive data masked in logsIn place
Phone, ID and card numbers are masked in our logs.
- Backups and restore testsIn place
Production data is backed up daily, and restores are tested regularly.
Network securityNETWORK
- Encryption in transitIn place
All traffic to our dashboard, APIs and websites uses HTTPS (TLS).
- No direct database accessIn place
Production databases cannot be reached from the internet.
- Restricted infrastructureIn place
No servers are open to remote login from the internet.
- Security logging and alertsIn place
Access to production data and changes to access rights are logged and alert the team.
Application securityAPP
- Secure credentialsIn place
Passwords are stored as one-way hashes, and service credentials are kept in a managed secrets vault.
- Sign-in protectionIn place
Repeated failed sign-ins are rate-limited and locked out.
- Tested, reversible releasesIn place
Releases run automated tests and security checks and can be rolled back quickly.
- Privacy noticeIn place
A current privacy policy, terms and acceptable-use policy are published and accepted by customers.
AI and callsVOICE
- Recording noticeIn place
Customers can play a recording notice at the start of every call.
- Agents tested before releaseIn place
Agent changes are tested against realistic conversations before they go live.
Documents
Public documents are linked. The security overview and our data processing agreement are shared with customers on request: write to dpo@conversailabs.com.
Subprocessors
Our main subprocessors. The full list, with what each one handles and where, is available to customers on request at dpo@conversailabs.com. Customers are told before we add one.
FAQ
Do you use our call data to train AI models?
We do not train or fine-tune AI models on customer calls. A customer's calls are used only to build, test and improve that customer's own agents. The AI providers we use process data through business APIs that do not train on it.
Who owns the call recordings and transcripts?
You do. We process them only to provide the service to you, as your Data Processor under India's DPDP Act. No ownership passes to us.
Where is our data stored and processed?
Stored in Google Cloud in India (Mumbai and Delhi). Some AI providers, such as speech and language models, process call audio or text outside India while a call is running. The full list of providers and their locations is available to customers on request.
How long do you keep recordings?
While your account is active, until you ask us to delete them. Per-customer retention periods with automatic deletion are being built.
How do we report a security issue or incident?
Email dpo@conversailabs.com. We acknowledge within 24 hours. If a breach affects your data we tell you without undue delay, so you can meet your own reporting duties.