Trust Center

Built for the procurement bar.

Every voice agent SynthVoice runs is wired through the same security primitives: tenant-isolated storage, encrypted transcripts, redacted PII, audited mutations, and accountable sub-processors. This page is the source of truth for your security review.

Current Posture

SOC2
SOC 2 Type IIAnnual report · Q1 2026
HIPAA
HIPAABAA available
GDPR
GDPR + SCCsEU DPA & SCCs
ISO
ISO 27001Certified
PCI
PCI DSSSAQ-D · L2
CCPA
CCPA + CPRAConsumer rights
99.95%
Production uptime SLA
<72h
Breach notification commitment
AES-256
At-rest encryption · KMS-backed
100%
Audited mutations across the platform

01 — Certifications & Attestations

Independently audited. Documented. Available on request.

Reports and attestations are reviewed under NDA via our trust portal. Status reflects the most recently completed audit cycle.

SOC 2

SOC 2 Type II

Annual report covering Security, Availability, and Confidentiality criteria. Audited by a Big-4 affiliated CPA firm.

Available · Q1 2026 cycle
ISO

ISO/IEC 27001

Information Security Management System certified. Applies to platform engineering, operations, and customer data handling.

Certified
HIPAA

HIPAA

Business Associate Agreement (BAA) signed for healthcare deployments. Configurable retention and PHI redaction.

BAA available
GDPR

GDPR + UK GDPR

Data Processing Addendum and Standard Contractual Clauses available. EU data residency option included.

DPA · SCCs · TIA
PCI

PCI DSS

SAQ-D Level 2. Cardholder data is never written to platform storage — payment flows route through a tokenized integration.

Compliant
CCPA

CCPA / CPRA

California consumer rights honored across the platform: access, deletion, portability, opt-out of sale and sharing.

Compliant
TX

TX-RAMP / StateRAMP

State-level authorization frameworks for public sector deployments. In-process toward Level 1 attestation.

In progress · 2026
Fed

FedRAMP Tailored

Roadmap engagement for U.S. federal customers. Speak to your account team for the current authorization plan.

Roadmap · 2027

02 — Architecture & Tenant Isolation

Every tenant is its own logical and physical boundary.

Multi-tenant on the surface, isolated underneath. A request enters the platform, is authenticated, scoped to a tenant, and stays inside that tenant's row-level data plane until it returns to the caller. There is no path through the application that can cross-reference data between tenants.

Logical isolation

All persisted data carries a tenant_id claim. Database row-level security enforces tenant scoping at the engine level — even a SQL bug in application code can't return another tenant's row.

Network isolation

Each tenant's worker pool runs in a dedicated Kubernetes namespace with NetworkPolicy egress restrictions. Cross-tenant traffic is dropped at the CNI layer.

Storage isolation

Recordings and transcripts are written to per-tenant object storage prefixes with object-level KMS keys. A leaked URL still requires a valid signed grant.

Compute isolation

Optional dedicated-tenant deployments run agents on tenant-pinned node pools. Available on Enterprise plans for healthcare and financial services customers.

Caller
+1 415…
Edge
TLS 1.3
Tenant scope
Northstar Health
Agent runtime
Atlas-Prod
Tenant DB
RLS · KMS
Tenant store
s3://nh/…
tenant_id propagates through every hop · cross-tenant queries return zero rows by construction

03 — Data Protection

Encrypted in transit, at rest, and on the wire to every sub-processor.

Encryption at rest

AES-256-GCM via cloud KMS. Database, object storage, search index, message broker, and backup snapshots are all key-managed.

  • CipherAES-256-GCM
  • Key mgmtCloud KMS · CMEK
  • Key rotationEvery 90 days
  • Per-objectRecordings & transcripts

Encryption in transit

TLS 1.3 enforced on the public edge with HSTS. Internal service traffic is mTLS. SIP/RTP for telephony is encrypted via SRTP where the carrier supports it.

  • Public edgeTLS 1.3 · HSTS
  • InternalmTLS · SPIFFE IDs
  • VoiceSRTP · TLS-SIP
  • WebhooksHMAC-signed

Customer-Managed Keys (BYOK)

On Enterprise plans you can plug in your own KMS key. Revoking the key cryptoshreds your tenant's encrypted data — including ours.

  • Cloud KMSAWS, GCP, Azure
  • ScopeTenant-wide
  • RevocationCryptographic erase

Secrets & integrations

OAuth tokens and API keys you connect for CRM, telephony, and ticketing are stored in a hardware-backed vault, decrypted only in-memory at the moment of use.

  • VaultHashiCorp · HSM-sealed
  • AccessJust-in-time, audited
  • RotationOAuth refresh + 90d

04 — Identity & Access

SSO, SCIM, and a role model your IT team can actually implement.

Single Sign-On

SAML 2.0 and OIDC supported across major identity providers. Enforce SSO-only for every user in your workspace.

  • ProtocolsSAML 2.0 · OIDC
  • IdPsOkta, Azure AD, JumpCloud, Google, custom
  • EnforcementWorkspace-level SSO lock
  • SessionsIdle timeout configurable 5m–24h

SCIM Provisioning

Automated user lifecycle from your IdP. Users provisioned, groups mapped to roles, deprovisioning revokes session tokens within 60 seconds.

  • SpecSCIM 2.0
  • OperationsCreate, update, deactivate, group sync
  • Deprovision SLA<60s token revocation

Role-Based Access

Four built-in roles plus custom roles on Enterprise. Permissions scope to the tenant, sub-tenant, and resource level.

  • Super-adminWorkspace-wide control
  • AdminTenant-scoped configuration
  • OperatorRun campaigns, listen to calls
  • Read-onlyReporting, no mutations
  • CustomEnterprise — fine-grained scopes

MFA & API Keys

TOTP and WebAuthn for human users. API keys are scoped, rotatable, expirable, and IP-allowlistable.

  • MFATOTP · WebAuthn (FIDO2)
  • API keysScoped · expiring · rotatable
  • IP allowlistsCIDR per key

05 — Audit Logging

Every record is exportable.

We log who did what, when, from where — across the console, the API, and internal operations. Streamed in real time to your SIEM or pulled on demand.

Coverage

Authentication events, role changes, agent edits, campaign starts/pauses, tool registration, knowledge updates, recording exports, key rotations, and console viewing of recordings.

Retention

Audit logs retained for 13 months by default. Extendable to 7 years on Enterprise plans for regulated industries.

Streaming

Push audit events to Splunk, Datadog, Sumo, or any HTTPS endpoint via webhook. JSON-structured, schema-versioned, deduped.

Tamper-evidence

Append-only, hash-chained log segments. Daily Merkle root signed with our signing key — verifiable that no past entries were rewritten.

06 — Sub-processors

Every vendor in our stack is enterprise-grade and contractually bound.

SynthVoice runs on a vetted set of cloud, telephony, AI, and observability providers — every one SOC 2 Type II audited, every one under a Data Processing Agreement that prohibits training on Customer Data and mandates breach-notification timelines. We don't publish the full vendor list publicly to limit attack surface. It's available to qualified prospects under NDA during procurement.

Vendor standard

SOC 2 Type II minimum

Every sub-processor handling Customer Data carries an active SOC 2 Type II report. ISO 27001 and HIPAA where applicable to the data category.

No training

Zero-retention LLM & STT

All inference and speech vendors operate under zero-retention enterprise agreements. Your conversation data is never used to train any third-party model.

Change notice

30 days advance notice

Customers receive 30 days written notice before any new sub-processor is engaged for Customer Data, with the right to object.

Procurement teams: request the full sub-processor list, DPAs, and a redacted SOC 2 report at security@synthvoice.ai.

07 — Data Retention

Defaults you can live with. Configurable to your policy.

Every data type has a default retention window and a configurable bound. Healthcare, financial, and government tenants typically tighten these defaults during onboarding.

Data Type Default Retention Min — Max Storage Deletion on Termination
Call recordings (audio) 90 days 0d — 7y Object storage · KMS 30 days post-termination
Call transcripts (text) 365 days 7d — 7y Encrypted DB 30 days post-termination
Call summaries & tags 365 days 30d — 7y Encrypted DB 30 days post-termination
Caller PII (phone, name, etc.) Tied to call lifecycle Configurable redaction Encrypted DB · per-field KMS 30 days post-termination
Knowledge sources Until deleted by customer N/A Encrypted DB · vector index 30 days post-termination
Audit logs 13 months 90d — 7y Append-only, hash-chained Retained per regulatory minimum
Backups (operational) 35 days rolling Fixed window Encrypted snapshots Cycled out within 35 days
Operational telemetry 30 days PII-redacted Observability platform · audited Cycled out within 30 days
Suppression / opt-out lists Indefinite Customer-controlled Encrypted DB Retained — required for compliance

Customer Data is purged within 30 days of contract termination unless a longer retention is contractually required (legal hold, regulatory archive, suppression registry).

08 — Data Residency

Pin your tenant to a region. We won't move it.

Tenant data is processed and stored in the region you select at workspace creation. Regional pinning includes the database, object storage, search index, and the inference endpoints we route to.

Available regions

  • us-eastN. Virginia · default
  • us-westOregon
  • eu-centralFrankfurt · GDPR pin
  • eu-westIreland
  • uk-southLondon
  • ap-southeastSydney
  • ca-centralMontréal

Cross-border transfers

For EU and UK customers, GDPR and UK GDPR transfers rely on Standard Contractual Clauses and a Transfer Impact Assessment. Inference endpoints are region-pinned to match — EU tenants are not routed to US LLM inference unless explicitly opted in.

  • SCCsModule 2 & 3 included in DPA
  • TIAAvailable under NDA
  • EU-only inferenceAvailable for EU tenants

09 — Telephony & TCPA Compliance

Calling rules enforced at the platform layer — not left to the operator.

Calling-hour windows

Outbound campaigns honor recipient-timezone calling windows by default (8am–9pm local). State-level overrides (e.g., Florida 8am–8pm) automatically apply.

Suppression & DNC

Internal Do-Not-Call lists are checked on every dial. Federal DNC and state DNC scrubbing available for Enterprise. Opt-out responses are honored within 30 seconds across all campaigns.

Caller ID registration

STIR/SHAKEN attestation A on all outbound calls. Caller ID names registered in the FCC RND. Branded caller ID for supported carriers.

Recording disclosure

Two-party-consent disclosure plays automatically when the caller's state requires it. Disclosure templates per locale; fully customizable.

SMS sender registration

10DLC, toll-free, and short-code messaging supported with carrier-required brand and campaign registration. Throughput rate-limits enforced by sender class.

Consent capture

Per-contact consent records — what was agreed, when, and through what channel — are stored and retrievable for evidentiary purposes.

10 — Incident Response

A documented runbook. A 24/7 on-call. A 72-hour notification commitment.

If we confirm a security incident affecting your data, you'll hear from us — fast, in writing, with what we know and what we're doing about it.

T+0

Detection

Internal monitoring, customer report, or external researcher disclosure triggers an incident channel. Severity assigned within 15 minutes.

T+1h

Triage & containment

Incident commander assigned. Affected systems isolated. Forensic timeline started. Customer impact scope estimated.

T+24h

Eradication

Root cause identified. Mitigation deployed. Vulnerability patched in dev, staged, and production paths.

T+72h

Customer notification

Affected customers notified in writing — via email to the security contact on file and a posted incident on status.synthvoice.ai. Includes scope, data categories, mitigation, and customer guidance.

T+10d

Post-incident report

Written PIR delivered to affected customers. Includes root cause, timeline, impact, remediation, and durable controls added to prevent recurrence.

11 — Business Continuity

RTO and RPO we publish — and test against.

Recovery objectives

  • RTO4 hours · regional failover
  • RPO15 minutes · point-in-time
  • Uptime SLA99.95% production
  • DR testTwice per year, full failover

Backup posture

Continuous WAL streaming to a secondary region. Encrypted snapshots on a 35-day rolling window. Restore-from-backup drills quarterly.

Multi-region

Production runs across at least two cloud availability zones per region. Regional failover automated for eligible workloads; manual cutover documented for the rest.

Carrier failover

Telephony has a primary and secondary carrier. Automatic failover within 30 seconds of carrier-side detection — no DNS changes required by customer.

12 — Responsible Disclosure

Found something? We want to hear about it.

Researchers acting in good faith, within the scope of our policy, will not be subject to legal action or service termination. We commit to acknowledging receipt within 2 business days and providing remediation status within 14 days.

Channel

Send reports to security@synthvoice.ai — encrypted to our PGP key (fingerprint published in /.well-known/security.txt).

  • Emailsecurity@synthvoice.ai
  • PGP keyAvailable at /.well-known/security.txt
  • HackerOnePrivate program — invite-only

In scope

  • Apexsynthvoice.ai · *.synthvoice.ai
  • APIapi.synthvoice.ai/v1/*
  • Consoleapp.synthvoice.ai
  • Out of scopeMarketing site CMS, third-party SaaS, social engineering

13 — Procurement Documents

The full pack — for your security team.

Documents marked "NDA" are released through our trust portal once a mutual NDA is in place.

14 — Procurement FAQ

The questions security teams actually ask.

Is Customer Data ever used to train models?

No. Every LLM, TTS, and STT vendor in our stack operates under a zero-retention enterprise agreement that contractually prohibits training on Customer Data. We do not fine-tune any model on Customer Data without an opt-in agreement specific to your tenant. Specific vendor names and the executed DPAs are available to qualified prospects under NDA during procurement.

Where is our data stored?

In the region you select at workspace creation. Available regions: us-east, us-west, eu-central, eu-west, uk-south, ca-central, ap-southeast. Database, object storage, search index, and inference endpoints are all pinned to that region. EU and UK tenants can require EU-only inference at workspace creation.

How do you handle a subpoena or government data request?

Our Government Request Policy applies: we challenge overbroad requests, require legal process, and notify the affected customer unless legally prohibited. We publish an annual Transparency Report. The Customer remains the data controller — most requests should be served on the Customer directly.

Can we use our own KMS keys?

Yes, on Enterprise. Bring your own AWS, GCP, or Azure KMS key. Revoking your key cryptographically erases your tenant's encrypted data — including our copy. Limitation: BYOK applies to data at rest; transient in-memory processing requires plaintext access during the call.

What happens if we terminate?

Customer Data is purged from production systems within 30 days of contract termination. Operational backups roll out within 35 days. We retain only what is required by law: suppression registries, transaction records, and audit logs needed for regulatory minimums. A Certificate of Destruction is available on request.

Do you train on call recordings or transcripts?

No. Call recordings, transcripts, and any derived embeddings are tenant-scoped and used only to power features for that tenant (e.g., search, summary, retrieval). They are not pooled across tenants and not used to train any model.

Can we restrict which sub-processors are used for our tenant?

Limited tenant-level routing is available on Enterprise — for example, US-only inference, or excluding a specific carrier. Fully bespoke sub-processor exclusion lists are negotiated case-by-case during procurement.

How is PII redacted in transcripts?

Configurable per agent. Built-in patterns for credit cards, SSNs, account numbers, and DOBs. Custom regex patterns are supported. Redaction happens before transcripts are written to durable storage and before any logging or analytics ingest.

What is your breach notification SLA?

72 hours from confirmed incident, written notification to the security contact on file, with scope, data categories, and remediation status. A post-incident report follows within 10 business days.

Is your platform deployable in our private cloud?

For qualifying Enterprise customers — typically large healthcare networks, financial institutions, and government — we offer single-tenant deployments and private VPC peering. Speak to your account team for the deployment matrix.

What happens during a DDoS or regional outage?

Edge sits behind a multi-vendor DDoS shield. Rate limits per API key and per tenant prevent abuse-driven cascades. Regional failover auto-routes eligible workloads within RTO; status.synthvoice.ai is the live source of truth.

How do you secure your own employees and access?

SSO + WebAuthn enforced for all production access. Device posture (MDM-managed, encrypted, current OS) required for all engineering laptops. Just-in-time, audited access to production — no standing prod credentials. Background checks at hiring and annual security training.

Talk to security

We'll walk your security team through whatever they need.

Our security and compliance team takes calls directly. Bring your SIG-Lite, your VRA questionnaire, or your worst-case scenario — we'll answer in writing.

Email Us Download the pack