00 Security
Everything below is checkable.
Most voice-AI sites show you a row of logos. We surveyed 59 of them: several display certification marks with no certificate number, no auditor, and no date — and at least two contradict their own trust portals. So here is the register instead, including the rows where the honest answer is "no".
01 The compliance register
What we hold, and what we don't hold yet.
A certification is a commercial credential, not a licence to trade. We list ours the way an auditor would read it — with the status first and the excuse nowhere.
Gap assessment under way against Annex A. We are not certified today and will not display the mark until a certificate with a registrar and a scope statement exists to link to.
In progressControls are being documented ahead of an observation window. Under AICPA rules the SOC logo belongs only to a completed report, so there is no badge here and will not be one until there is a report to hand you under NDA.
In progressThere is no certification scheme under the DPDP Act — nobody is "DPDP certified", and any competitor badge claiming otherwise is a self-assertion. The substantive obligations phase in to mid-May 2027. Our notice, consent, erasure and data-principal-rights work is tracked against that date. See the Privacy Policy.
AligningA named officer, published contact details, acknowledgement within 24 hours and disposal within 15 days. Legally required of every Indian intermediary, and only 4 of the 14 Indian competitors we surveyed publish one. Ours is being appointed — until the name is on the privacy page, this row does not get a tick.
Being appointedMandatory since 2022: incident reporting within 6 hours, ICT logs retained 180 days within Indian jurisdiction, clocks synchronised to NIC/NPL NTP. The reporting path and log-retention runbook are being written; we will not tick this until they are exercised. Note that "CERT-In empanelled" describes an auditing firm — a product company cannot hold it, and we do not claim it.
In progressRequired for outbound commercial calling, where an AI dialler is a dialler and there is no AI exemption. TringTring answers calls your customers place to you. If you run outbound campaigns on it, DLT registration is yours to hold and we will tell you so before you buy.
Scope-dependentOut of scope by design. The platform does not capture, transmit or store card numbers, and the agent is instructed never to collect one. If your flow needs payment capture we will hand the caller to a payment IVR rather than bring card data in scope.
Out of scopeWe do not sign BAAs today. HIPAA has no certifying authority, so "HIPAA certified" is not a thing anyone can be — vendors who claim it mean they will sign a BAA, and several charge extra for it. We would rather say no than sell you a word.
Not heldOn the roadmap and worth naming because it is the standard most relevant to an AI answering your phone. Exactly one company in our 59-competitor survey holds it.
Not heldWe sell in India and do not currently offer services to, or monitor the behaviour of, EEA data subjects, so we appoint no Article 27 representative. If that changes this row changes with it.
Not applicable02 What actually runs
The controls behind the register.
Everything in transit. The site and the app are served over HTTPS with HSTS and a strict Content-Security-Policy. The voice stream runs over an authenticated WebSocket, never plain ws://.
Passwords are never recoverable. Hashed with scrypt (N=16384, r=8) and a per-account salt. The hash column is deliberately excluded from every query in the application except the one that verifies a sign-in.
Sessions expire. A session is a random 256-bit token stored only as a SHA-256 hash, valid 30 days, revocable individually from your account page. You can see every live session and end any of them.
Your agent's instructions never reach a browser. The prompt that describes your business is resolved server-side and scoped to your account in the database query itself. It is not in the page payload and it is not in the JavaScript bundle.
A control you can verify beats a logo you have to trust.
03 Your data
Where a call goes, and how long it stays.
What a call produces
Three artefacts: an audio recording, a transcript, and an AI-written summary. Recordings are held in object storage that is reachable only from the application server — there are no public object URLs, and a recording is streamed through an authenticated endpoint that checks it belongs to your account before a single byte is sent.
Retention
| Artefact | Where | Retention |
|---|---|---|
| Call recording | Private object storage | Kept until you delete it or the account closes |
| Transcript & summary | PostgreSQL | Same |
| Agent instructions | PostgreSQL | Until the agent is archived |
| Enquiries you send us | PostgreSQL | Kept until you ask us to delete them — and deleted automatically with your account if you open one |
| Session records | PostgreSQL | 30 days, then swept |
| Rate-limit counters | Redis | Self-expiring — 1 hour for most, 10 minutes for one |
Archiving an agent never deletes its call history — the record of what was said to your customers outlives the agent that said it, which is the behaviour an audit needs.
Getting your data out, and getting it deleted
Both are buttons on your account page, not an email to support.
- Export — your profile, every agent (including its instructions), and every call transcript and summary, as one JSON file, with a link to each recording.
- Close account — deletes every recording from object storage first, then the account and everything cascading from it — including any enquiry you sent us from the marketing site before you signed up, which is matched on your email and phone because it predates the account and cannot be linked to it. If object storage is unreachable the deletion aborts before touching a single row, so we can never tell you your data is gone while the audio is still sitting in a bucket.
There is no soft-delete and no grace period. You type your phone number back to confirm, and then it is gone.
Sub-processors
Named, not described in the abstract. These are the third parties that can process content from a call:
| Processor | Purpose | What it sees |
|---|---|---|
| Google (Gemini API) | Writes your agent's instructions; writes call summaries | The intake transcript; call transcripts |
| Anthropic (Claude API) | Writes your agent's instructions, where enabled | The intake transcript |
| Hosted voice service | Speech recognition and synthesis during a live call | Call audio, in real time |
| Google Fonts | Typefaces on this marketing site | Your IP address when a font loads |
We will give you the current list in writing, with entity names and processing locations, before you sign anything. Ask on the contact route. See also the LLM Policy, which covers what these models may and may not do with what they see.
Call recording and consent
India is a one-party-consent jurisdiction for the act of recording, but that answers the interception question, not the data-protection one: a voice is personal data because a voice identifies a person. Under the DPDP Act your callers are entitled to notice of the purpose, and to erasure once that purpose is served.
Our position, in writing: you are the data fiduciary for your callers and you decide the disclosure. We give you the announcement, we play it, and we retain the evidence that it played. We do not quietly make that your problem in a clause you never read.
04 Reporting a problem
Found something? Tell us.
Responsible disclosure
- ai@globalvoxinc.com
- Response
- Acknowledged within 3 working days
- Safe harbour
- Report in good faith, give us reasonable time, and do not access data that is not yours — and we will not pursue you.
Please do not run automated scanning against the live voice path: every session is metered, so a scanner costs real money and degrades service for callers who are not you.
Security review to run? Send it over.
We answer questionnaires with evidence, and "not yet" where that is the truth.