Security
Calls are the most sensitive data you own.
People say things out loud on the phone they would never type into a form: card numbers, medical detail, a reason they are behind on a payment. Everything below exists because of that.
- 01
Encryption everywhere
TLS 1.3 in transit, AES-256 at rest, and SRTP on the media path. Keys are managed per region and rotated on a schedule.
- 02
Access that expires
Role based access inside your workspace, hardware keys and just-in-time elevation for our staff, and an audit log that records who opened which call.
- 03
Retention you set
Choose a window from 7 days to 7 years per workspace. Deleting a call removes the audio, the transcript and the derived scores together.
- 04
Consent on the record
Per-campaign disclosure, recording and consent switches, with the setting that was in force stamped onto every call for later review.
- 05
Data residency
Pin a workspace to a region and call data stays there, including transcripts and model context. Cross-border transfers run on Standard Contractual Clauses.
- 06
Your data is not training data
We do not train general purpose models on your audio or transcripts. Tuning that improves your agents happens inside your workspace and stays there.
Documentation
The paperwork your reviewer will ask for.
Ask for any of these and we will tell you plainly what exists today and what is still in progress. Questionnaires come back inside three working days.
Data processing agreement
Our standard DPA, with Standard Contractual Clauses and the UK addendum. Available today.
Subprocessor list
Every vendor that can touch call data, and notice before we add one. Available today.
Security questionnaire
Send us yours. We answer in your format rather than pointing you at a portal.
SOC 2 Type II
In progress. We are in the observation window and will share the report and our current control set when it closes. Ask and we will tell you exactly where it stands.
Disclosure
Found something? Tell us first.
Send it to security@tringtring.ai. We acknowledge inside one working day, give you a severity assessment inside three, and keep you updated until it is closed.
Test against your own workspace only. Do not touch other tenants, do not run load or denial-of-service tests, and do not access call recordings that are not yours. Stay inside those lines and we will not pursue you, and we will credit you if you want the credit.
Send us the questionnaire.
Most reviews stall on a missing document. Ask for the set up front and we will have your security team unblocked this week.