Security & subprocessors
What protects your call data, and what doesn't exist yet.
Last updated 2026 · Security questions: hello@proofdial.audio
We sell evidence that has to survive being checked by someone hostile. A security page that overstates its controls fails that standard before a single audit runs, so this one lists only what is implemented, names every third party that can see your audio, and keeps a section for the things we do not have. See also privacy & data handling for retention and deletion.
Controls in place
PII is redacted before a transcript is stored
Transcription happens in memory, and the transcript is passed through entity redaction before anything is written to the database. Phone numbers, email addresses, card numbers, bank and national identifiers are replaced with placeholders. The redacted transcript is the one the judge reads, the one the report shows, and the only one persisted, so a finding can never quote a customer's card number back at you.
Findings are computed on the redacted text
This matters more than it sounds: it means the evidence in a report is reproducible from exactly what the report displays. Nothing is scored against a hidden fuller version of the call.
Your vendor API keys are encrypted at rest, and write-only
When you connect an agent platform, the key is encrypted with a derived Fernet key before storage and can never be read back through the UI or the API. You see a masked hint only. Changing platforms requires a new key rather than carrying the old one over, so one vendor's credential is never presented to another.
Reports and audio are private by default
A report is reachable only if you publish it or share its unguessable token. Audio is served through a media endpoint that requires that same token; an unpublished run returns 404 rather than a permission error, so the existence of a report is not discoverable either.
Inbound call webhooks are signature-verified
Twilio ingestion validates the provider's request signature before accepting a recording, and the fetch that follows is restricted to the provider's own API host. A guessed callback URL cannot inject a recording into your workspace, and cannot be used to make our servers fetch an arbitrary address.
Tenant isolation is enforced per query, not per page
Workspace and organization scoping is applied in the data layer on every read, and role permissions (owner, admin, analyst, viewer) gate the actions that create runs, spend quota or place calls.
Phone calls require separate written authorization
The phone channel will not dial a number until someone with authority explicitly authorizes that specific line, recorded with who authorized it and when. Changing the number revokes that authorization, because consent was given for one line.
Every operator action on your data is logged
Staff actions (resolving a dispute, withdrawing a finding, publishing a report) are written to an append-only action log with the actor and timestamp, and dispute outcomes are shown on the report itself rather than applied silently.
Subprocessors
Third parties that may process customer audio, transcripts or contact details in the course of running an audit. Ask us for the current named vendors and regions for your deployment, we will put them in writing.
| Category | Data it sees | Why |
|---|---|---|
| Speech-to-text provider | Call audio | Recordings are sent for transcription. Which provider is used depends on your deployment's configuration, and the report states it affects evidence quality: a provider that separates speakers properly produces stronger evidence than one that guesses. |
| Judge model provider | Redacted transcripts | Model-scored findings are produced by a large language model reading the redacted transcript. Audio is never sent to it, and neither are unredacted transcripts. |
| Telephony provider | Call audio & metadata | Only when you use the phone channel, and only for the number you authorized. Recordings are copied into our own storage immediately, because provider retention is measured in days and evidence has to outlive that. |
| Object storage & database host | Audio, transcripts, findings | Where your evidence lives at rest. |
| Transactional email provider | Email addresses | Verification, password reset and alert email. No marketing lists, no tracking pixels. |
What we do not have yet
Listed because you would find out anyway, and finding out in a contract review is worse for both of us.
SOC 2 Type II
We are not certified and we will not imply we are. If your procurement requires it, say so early, because it is a real cost and a real timeline, not a checkbox we can produce on request.
HIPAA Business Associate Agreement
We have not executed BAAs. The redaction and access controls above are genuinely relevant to a patient-facing phone line, but they are not a substitute for a BAA, and you should not treat them as one.
SSO / SAML / SCIM
Not implemented. Access is email-and-password with role-based permissions. This was previously listed as an Enterprise feature by mistake, and it was removed rather than quietly built into a roadmap slide.
Data residency guarantees
We cannot currently commit to keeping your data inside a specific region. If EU-only processing is a requirement for you, that is a conversation to have before you upload anything.
Customer-managed encryption keys
Encryption at rest uses our keys, not yours.
Reporting a vulnerability
Email hello@proofdial.audiowith enough detail to reproduce the issue. We will acknowledge within one business day. Please do not test against another customer's workspace, run automated scans against production, or access data that is not yours. Report it and we will reproduce it ourselves.