Security you can put in front of your regulator.
Every call carries someone's data and someone's trust. Here is how VoiFlow protects both: where data lives, who can touch it, what the agent may do with it, and how you can prove all of it afterwards.
- Encrypted in transit and at rest
- Data stays in the region you choose
- Never used to train shared models
- Every action on the record
Seven layers between a call and a risk.
- 01
Network & telephony
Every leg of the call is encrypted.Voice and media run on isolated infrastructure, separate from the web tier, over encrypted carrier trunks.
- TLS and SRTP on every leg
- Isolated media and telephony tier
- Per-tenant limits against toll fraud
- 02
Encryption in transit and at rest
Unreadable in motion and at rest.Recordings, transcripts, files and messages are encrypted on the wire and on disk, with keys held per region.
- TLS 1.2 or higher in transit
- AES-256 at rest
- Keys managed and rotated per region
- 03
Identity & access
The right people, and nobody else.Every workspace is isolated. Staff get roles and the least access they need, and every elevation is logged.
- Single sign-on and role-based access
- Workspace-level isolation
- Logged break-glass access for our staff
- 04
Data residency & in-country hosting
Your data lives where you say it does.Choose the region for recordings, transcripts and records. Government and regulated teams can stay in-country.
- UAE, Malaysia, UK and EU, and US regions
- In-country hosting for the public sector
- Region-pinned processing where providers allow
- 05
Audit & accountability
Every action leaves a record.Who did what, when and why is captured for calls, messages, agent actions and admin changes, then exported to you.
- Complete call, action and change history
- Exportable to your own tools
- Retention set by your policy
- 06
AI guardrails
The agent knows where its limits are.Permissions per action, consent handling and redaction are enforced outside the model, with an instant pause.
- Approval before anything beyond its rules
- Consent and recording notices
- Redaction of sensitive details in transcripts
- 07
People & process
Security is how we work, not a department.Vetted staff, reviewed changes and rehearsed incident response, with named owners and prompt customer notice.
- Background-checked staff, regular training
- Peer-reviewed changes before release
- Incident response with named owners
Your data lives where you say it does.
Pick the region for recordings, transcripts, files and records. Government and regulated teams can keep everything in-country, and every region has its own law behind it.
Hosted in Malaysia
Malaysian and regional data stays in Malaysia, with records ready for the way banks and healthcare groups audit.
- Malaysia PDPA
- Singapore PDPA
- Recordings stay in region
- Transcripts stay in region
- Records stay in region
What we promise about the data in every call.
Plain commitments, written into the contract and enforced by the platform rather than by good intentions.
Never used to train shared models
Your calls, transcripts and files improve your own agent. They are not used to train models that anyone else uses.
Retention you control
Keep recordings for 30 days, 90 days, or not at all. Set it per workspace, and it is enforced automatically.
Recording notices built in
The agent says it is recording where the law or your policy requires, in the caller's language.
Do-not-call, honoured everywhere
Opt-out and do-not-call lists are checked before every outbound dial and respected on every channel.
Deletion on request
Remove a customer from recordings, transcripts, files and messages in one request, with a confirmation record.
Redaction by default
Card numbers and identity details can be masked in transcripts and summaries before they are stored.
Built with compliance in mind, for the standards your auditors use.
Designed to meet the requirements of these frameworks. Ask for our security pack to see how each one maps to our controls.
An agent with limits you can read.
Putting an AI on your phone line is a promise to your customers. These are the rules we hold every VoiFlow agent to.
Honest about what it is
If a caller sincerely asks whether they are speaking to an AI, the agent says so. It never invents a human name for itself.
Limits it cannot talk its way past
Permissions are enforced by the platform, not by a prompt. The agent cannot do what its rules do not allow.
A person is always one step away
Callers can ask for a human at any point, and the handoff carries the whole conversation with it.
Reviewed before and after launch
Every agent is tested on your own scenarios before it goes live, and every call can be replayed and corrected after.
Who helps us process your data.
The categories of provider we rely on, what they handle and where. The named list is kept current in the Data Processing Agreement.
| Provider | Purpose | Data handled | Location |
|---|---|---|---|
| Cloud infrastructure provider | Hosting, storage and compute | All service data, encrypted | Region you choose |
| Telephony carriers | Numbers and call transport | Call audio, numbers, call metadata | Country of the line |
| Speech and language model providers | Transcription, voice and reasoning | Call audio and text during the call | Region-pinned where offered |
| Messaging providers | WhatsApp, SMS and email delivery | Message content and delivery status | Per provider |
| Payment processor | Subscriptions and top-ups | Billing contact and payment token | Per provider |
| Support tooling | Support tickets and status page | Contact details and ticket content | UK and EU |
- Cloud infrastructure provider
- Purpose
- Hosting, storage and compute
- Data handled
- All service data, encrypted
- Location
- Region you choose
- Telephony carriers
- Purpose
- Numbers and call transport
- Data handled
- Call audio, numbers, call metadata
- Location
- Country of the line
- Speech and language model providers
- Purpose
- Transcription, voice and reasoning
- Data handled
- Call audio and text during the call
- Location
- Region-pinned where offered
- Messaging providers
- Purpose
- WhatsApp, SMS and email delivery
- Data handled
- Message content and delivery status
- Location
- Per provider
- Payment processor
- Purpose
- Subscriptions and top-ups
- Data handled
- Billing contact and payment token
- Location
- Per provider
- Support tooling
- Purpose
- Support tickets and status page
- Data handled
- Contact details and ticket content
- Location
- UK and EU
The legal detail, in full.
Hear how it handles a real call.
Call the agent, then ask it about consent, recording and what happens to the data. It will tell you straight.
