Trust Center
DialPhone carries customer conversations, calls, messages, recordings, AI summaries, across US & Canada countries. Security, privacy, and reliability are not features. They are the floor.
Eight independently-verified certifications form the floor. SOC 2 Type II audits the operating model, ISO 27001 audits the information-security management system, HIPAA BAA covers protected health information, GDPR with EU data residency covers European personal data, PCI-DSS Level 1 covers payment-card-over-phone, FINRA and SEC 17a-4 cover broker-dealer recording retention, CCPA / CPRA covers California consumer rights, and STIR/SHAKEN A-level attests outbound caller ID against carrier robocall mitigation.
Four operational pillars carry that floor day-to-day: security (seven-layer defense, 24/7 SOC), privacy (no sale of data, no model training without opt-in), reliability (99.999% contractual uptime with service credits), and responsible AI (human-in-the-loop, audit logs per AI decision, complete opt-out).
Seven-layer defense: end-to-end encryption, private cloud hardening, real-time threat detection, penetration testing, bug bounty, SIEM, 24/7 NOC.
Customer data is processed for service delivery only. No secondary use, no training AI models on customer calls without explicit opt-in.
99.999% uptime SLA across voice, meetings, and CCaaS. Four redundant data centers, active-active failover, geo-diverse carrier routes.
Human-in-the-loop by default, transparent model disclosures, bias testing, customer data never used to train shared models.
Every control below is audited by an accredited third party on a repeating cycle. Reports and letters are available to customers and qualified prospects under NDA.
Audited annually by an independent CPA firm
BAA available on Advanced and Ultra plans
EU data residency, full DPA, subprocessor registry
Level 1 for payment IVR and card-capture flows
Immutable recording archive for broker-dealers
California consumer data rights honored globally
Information security management certification
Caller-ID attestation for US outbound
If you believe you’ve found a security issue, we want to hear from you. Researchers acting in good faith are protected under a safe-harbor policy.
Yes. DialPhone is audited annually to SOC 2 Type II across Security, Availability, Confidentiality, and Processing Integrity. The full report is available under NDA, request a copy.
Customers on Advanced, Ultra, and all Contact Center tiers receive a BAA at no additional cost. Email [email protected] with subject "BAA request" to e-sign. See the HIPAA page for covered features and technical safeguards.
US customers in US regions (Virginia, Oregon). EU customers in EU regions (Frankfurt, Dublin) with EU-only data residency. Data never crosses region boundaries unless the customer explicitly enables cross-region replication.
99.999% monthly uptime, contractual, with service credits for breach. The public status page reports real-time and historical incidents.
No, not without explicit opt-in. Shared foundation models are pretrained before customer data exists. Optional fine-tuning uses only data that the customer opts in per workspace, and that data never blends with other customers' data.
Email [email protected] (PGP key on this page) or submit via our coordinated disclosure portal. Acknowledgement within 24 hours, triage within 3 business days, rewards for in-scope findings.
Yes, the full subprocessor registry is public and updated whenever we add or remove a vendor. Existing customers are notified 30 days in advance of any change.
A FedRAMP Moderate package is in active sponsorship (target authorization Q4 2026). StateRAMP Moderate was awarded in 2025. Read the roadmap.
Export tools let you download recordings, messages, and call history anytime. After cancellation, data is retained for 30 days (in case you reinstate), then permanently deleted from primary storage and within 90 days from backups. Certificates of destruction available on request.
Trust Center