Data Processing Addendum

This Data Processing Addendum (the "DPA") forms part of, and is incorporated into, the OmnionAI Terms of Service (the "Agreement") between the customer identified in the Agreement ("Customer," "you") and 1001660987 Ontario Inc. ("OmnionAI," "we," "us"). It applies to OmnionAI’s processing of Personal Data on the Customer’s behalf in connection with the OmnionAI AI phone-receptionist service (the "Service"). It takes effect when the Customer accepts the Agreement. In the event of a conflict between this DPA and the rest of the Agreement, this DPA controls as to the processing of Personal Data; in the event of a conflict between this DPA and the Privacy Policy, this DPA controls as to processing carried out on the Customer’s behalf.

1. Definitions

• "Personal Data" means any information relating to an identified or identifiable natural person that OmnionAI processes on the Customer’s behalf under the Agreement. It includes "personal information" under Canada’s PIPEDA and under U.S. state privacy laws, and "personal data" under the EU and UK GDPR.
• "Customer Personal Data" means Personal Data about the Customer’s own personnel and authorised users — account holders, dashboard users, and notification recipients.
• "Caller Personal Data" means Personal Data about individuals who call, are called by, or message a phone number answered by the Service ("Callers"), including what a Caller says or provides during an interaction.
• "Processing" has the meaning given in Data Protection Laws and includes any operation performed on Personal Data. "Process," "Processed," and "Processes" are construed accordingly.
• "Controller," "Processor," "Data Subject," "Supervisory Authority," and "Personal Data Breach" have the meanings given in the GDPR. "Business," "Service Provider," "Consumer," "Sell," "Share," and "Business Purpose" have the meanings given in the CCPA.
• "Data Protection Laws" means all privacy and data protection laws applicable to a party’s Processing under this DPA, including PIPEDA and substantially similar provincial legislation; the California Consumer Privacy Act as amended by the CPRA and its regulations (the "CCPA") and other U.S. state privacy laws; and, where applicable, the EU GDPR and the UK GDPR together with the UK Data Protection Act 2018.
• "Subprocessor" means any third party engaged by OmnionAI to Process Personal Data in connection with the Service.
• "SCCs" means the Standard Contractual Clauses approved by European Commission Implementing Decision (EU) 2021/914. "UK Addendum" means the International Data Transfer Addendum to the SCCs issued by the UK Information Commissioner under section 119A of the UK Data Protection Act 2018.

2. Roles of the parties

For all Personal Data Processed through the Service in the course of answering, transcribing, summarising, routing, and following up on the Customer’s calls and messages:

• the Customer is the Controller (and, where the CCPA applies, the Business) and determines the purposes and means of the Processing; and
• OmnionAI is the Processor (and, where the CCPA applies, a Service Provider) and Processes that Personal Data only on the Customer’s documented instructions.

Where the Customer is itself a processor acting for another controller, the Customer warrants that it has that controller’s authority to enter into this DPA and to give the instructions it gives, and OmnionAI acts as a sub-processor; references to the Customer’s obligations are read as including that controller’s.

OmnionAI is an independent Controller for a limited set of processing carried out for its own purposes and not on the Customer’s behalf: account registration and administration, billing and payment, service and security communications, fraud and abuse prevention, aggregate and de-identified operational metering and capacity data that does not identify any Data Subject, and compliance with its own legal obligations. That processing is described in the Privacy Policy and is outside the scope of this DPA. For the avoidance of doubt, OmnionAI is not a Controller of Caller Personal Data or of call transcripts.

3. Scope, duration, and subject matter

The subject matter of the Processing is the provision of the Service. It begins when the Customer starts using the Service and continues for the term of the Agreement, plus the retention and deletion period described in Section 9. The nature, purposes, categories of Data Subject, and categories of Personal Data are set out in Annex I.

4. Customer instructions and warranties

Instructions. The Agreement, this DPA, and the configuration choices the Customer makes in the dashboard (greetings and scripts, knowledge-base content, booking and escalation rules, notification recipients and channels, integrations enabled, retention window, and any deletion request) together constitute the Customer’s complete and final documented instructions to OmnionAI regarding the Processing of Personal Data. Additional or different instructions require written agreement and may be subject to a fee where they require work outside the Service’s standard functionality. OmnionAI will notify the Customer if, in its opinion, an instruction infringes Data Protection Laws, and may suspend performance of that instruction (but not the rest of the Service) until it is withdrawn or amended.

Customer warranties. The Customer represents, warrants, and undertakes that:

• it has, and will maintain throughout the term, a valid legal basis (and, where required, consent) for the collection, use, and disclosure of all Personal Data it makes available to the Service and for OmnionAI’s Processing of it under this DPA, including its transfer to and Processing in the United States;
• it has given every notice and obtained every consent required by law — including under "one-party," "two-party," and "all-party" consent laws for the recording, monitoring, transcription, and analysis of calls and messages, and under laws requiring disclosure that an individual is interacting with an artificial-intelligence or automated system rather than a human — before any Caller interacts with the Service on its behalf, and will keep the automated recording and AI disclosure enabled wherever such notice or consent is required;
• its own privacy notice accurately describes its use of the Service, the AI processing of calls, and its use of a service provider that processes in the United States, and provides Callers with a means to exercise their rights;
• it will not submit to the Service, or configure the Service to elicit, any special category or sensitive personal data — including data revealing health or medical condition, racial or ethnic origin, political opinions, religious or philosophical beliefs, trade-union membership, sex life or sexual orientation, biometric or genetic data, precise geolocation, government identification numbers, or financial account or payment card numbers — nor any protected health information subject to HIPAA or personal health information subject to PHIPA or similar Canadian law. OmnionAI is not a HIPAA business associate and offers no Business Associate Agreement. The Service’s technical and organisational measures are not designed for such data, and the Customer is solely responsible if it is submitted anyway; and
• it will comply with its own obligations as Controller/Business under Data Protection Laws, including responding to Data Subject requests and to Callers, and with all applicable telemarketing, call-recording, and messaging laws including the TCPA, CASL, and CRTC rules.

For clarity, OmnionAI’s provision, defaulting, or technical enforcement of any disclosure wording is an aid to the Customer and is not a representation that such wording satisfies the Customer’s consent or disclosure obligations in any jurisdiction.

5. OmnionAI’s obligations

• Documented instructions only. OmnionAI will Process Personal Data only on the Customer’s documented instructions, including as to international transfers, unless required to do otherwise by law to which OmnionAI is subject; in that case OmnionAI will inform the Customer of that legal requirement before Processing, unless the law prohibits it on important grounds of public interest.
• No independent use. OmnionAI will not Process Personal Data for its own purposes, for the benefit of any other customer, or for any purpose other than providing, securing, and supporting the Service for the Customer. See Section 12, which states this in binding terms.
• Confidentiality of personnel. OmnionAI will ensure that every person authorised to Process Personal Data is subject to a binding duty of confidentiality (contractual or statutory) that survives the end of their engagement, is granted access only on a need-to-know basis for a defined task, and has been made aware of the confidential nature of the data.
• Security. OmnionAI will implement and maintain the technical and organisational measures set out in Annex II, and will not materially degrade the overall security of the Service during the term.
• Assistance with Data Subject requests. Taking into account the nature of the Processing, OmnionAI will provide reasonable assistance, by appropriate technical and organisational measures and insofar as possible, to enable the Customer to respond to requests to exercise Data Subject rights (access, correction, deletion, restriction, objection, portability, opt-out, and limitation of use). The Service’s dashboard allows the Customer to search, export, and delete call records, transcripts, extracted fields, leads, bookings, and messages itself; where the Customer cannot action a request through the dashboard, OmnionAI will assist on written request. If OmnionAI receives a request directly from a Data Subject relating to Personal Data Processed on the Customer’s behalf, it will not respond substantively except to acknowledge and redirect the individual, and will notify the Customer without undue delay.
• Assistance with breach notification and assessments. OmnionAI will provide reasonable assistance to the Customer with (a) notifications of a Personal Data Breach to supervisory authorities and affected individuals, (b) data protection impact assessments and privacy impact assessments, and (c) prior consultation with a supervisory authority, in each case only insofar as the assistance relates to Processing by OmnionAI and taking into account the information available to OmnionAI. OmnionAI may charge a reasonable fee for assistance that is disproportionate to the scale of the Service, and will say so before incurring it.
• Records. OmnionAI will maintain a record of the categories of Processing it carries out on behalf of the Customer, and will make it available to the Customer on reasonable written request.
• Accountability for Subprocessors. OmnionAI remains fully liable to the Customer for the performance of each Subprocessor’s data-protection obligations, as set out in Section 8.

6. Audit and information rights

OmnionAI will make available to the Customer all information reasonably necessary to demonstrate compliance with this DPA, and will allow for and contribute to audits, including inspections, conducted by the Customer or an auditor it mandates, subject to the following, which reflect the size and nature of OmnionAI’s operations:

• The Customer may exercise this right once in any twelve-month period, and additionally following a Personal Data Breach affecting the Customer’s Personal Data or where a Supervisory Authority requires it.
• The Customer will give at least thirty (30) days’ written notice, will conduct the audit during business hours, will not unreasonably interfere with OmnionAI’s operations, and will ensure its auditor is bound by confidentiality and is not a competitor of OmnionAI.
• OmnionAI may satisfy an audit request in the first instance by responding to a reasonable written security and privacy questionnaire and by providing then-current documentation of its measures. Where that response does not reasonably address the Customer’s enquiry, the Customer may proceed to an inspection.
• Audit scope is limited to systems, facilities, and records used to Process the Customer’s Personal Data. It does not extend to other customers’ data, to OmnionAI’s internal pricing or commercial information, or to Subprocessors’ own facilities; for Subprocessors, OmnionAI will provide the information it holds and will use reasonable efforts to obtain what the Customer reasonably requires.
• Each party bears its own costs, except that the Customer bears OmnionAI’s reasonable costs for an on-site inspection and for any audit beyond the annual entitlement.

7. Call audio, transcripts, and AI processing

Audio. On the current platform, the Service does not record or retain call audio. Audio is streamed in real time between the telephony carrier, the real-time voice infrastructure, and the speech models in order to conduct the call, and is not written to persistent storage by OmnionAI. OmnionAI therefore makes no commitment about deleting stored call recordings, because none are created. If OmnionAI later introduces call-audio recording or storage, it will update this DPA and the Privacy Policy and give notice before doing so.

Transcripts and extracted data. The Service does create and store a text transcript of each call and a set of AI-extracted fields (for example caller name, callback number, reason for calling, appointment details, and a short summary). These are Personal Data and are retained, deleted, and returned under Section 9. The Customer acknowledges that transcripts and AI-generated outputs are probabilistic and may be inaccurate or incomplete, and that it is responsible for reviewing them before relying on them.

No training. OmnionAI does not use Caller Personal Data, call content, transcripts, or extracted fields to train, fine-tune, or improve any artificial-intelligence or machine-learning model, whether its own or a third party’s, and contracts with its model Subprocessors on terms that do not permit them to do so. See Section 12.

8. Subprocessors

The Customer gives OmnionAI general written authorisation to engage Subprocessors to Process Personal Data. OmnionAI will impose on each Subprocessor, by written contract, data-protection obligations that are substantially equivalent to and no less protective than those in this DPA, and remains fully liable to the Customer for any failure by a Subprocessor to fulfil those obligations. The Subprocessors engaged as at the effective date are:

Changes and right to object. OmnionAI will give the Customer at least thirty (30) days’ notice before adding or replacing a Subprocessor that will Process Personal Data, by email to the Customer’s account contact. Within that period the Customer may object on reasonable, documented data-protection grounds. If it does, the parties will discuss in good faith; if OmnionAI cannot make the Service available without the objected-to Subprocessor and cannot offer a commercially reasonable alternative, the Customer may terminate the affected part of the Service on written notice, without penalty, and OmnionAI will refund any prepaid fees covering the period after termination. Termination on this ground is the Customer’s exclusive remedy. Where a change is urgently required to replace a Subprocessor for security, continuity, or legal reasons, OmnionAI may make it immediately and will notify the Customer as soon as practicable, and the objection right then applies retrospectively.

9. Retention, return, and deletion

OmnionAI retains transcripts and related call data for the retention window applicable to the Customer’s plan or the shorter period the Customer configures, after which a scheduled purge deletes or de-identifies them. The Customer may delete individual records at any time through the dashboard.

On expiry or termination of the Agreement, OmnionAI will, at the Customer’s election made in writing within thirty (30) days of the effective date of termination, return the Customer’s Personal Data in a commonly used machine-readable export format, or delete it. Absent an election within that period, OmnionAI will delete it. Deletion will be completed within ninety (90) days of termination or of the Customer’s request, and OmnionAI will instruct its Subprocessors to do the same. OmnionAI may retain Personal Data to the extent and for as long as required by applicable law, and copies may persist in routine encrypted backups until those backups expire on their normal rotation; Personal Data in backups remains subject to this DPA and is not restored into production except as part of a disaster-recovery event. OmnionAI will certify deletion in writing on request.

10. International transfers

Where processing happens. OmnionAI’s application servers, background worker, and PostgreSQL database are hosted with Render in the United States (Oregon region), and its real-time voice infrastructure runs on LiveKit Cloud in the United States (us-east). All other Subprocessors listed in Section 8 process in the United States. Accordingly, all Customer Personal Data and Caller Personal Data Processed through the Service is transferred to, processed in, and stored in the United States, regardless of where the Customer or the Caller is located. The Customer instructs OmnionAI to carry out those transfers and warrants that it has provided the notices and obtained any consents required for them.

Canada (PIPEDA). Where the Customer is subject to PIPEDA or substantially similar provincial legislation, the parties acknowledge that a transfer to a service provider for processing is a use, not a disclosure, and that the Customer remains accountable for Personal Data transferred to OmnionAI. OmnionAI provides a comparable level of protection through this DPA and the measures in Annex II. The Customer is responsible for informing individuals, in its own privacy notice, that their Personal Data may be processed in the United States and may be accessible to U.S. courts, law enforcement, and national-security authorities under the laws of that country.

EEA, UK, and Switzerland. Where the EU GDPR applies to Personal Data Processed under this DPA, the SCCs are incorporated by reference and apply to that Personal Data, with Module Two (controller to processor) applying where the Customer is a controller and Module Three (processor to processor) where the Customer is a processor, and with: the optional docking clause applying; Clause 9 Option 2 (general written authorisation) applying with the notice period in Section 8; Clause 11(a)’s optional independent-dispute-resolution wording not applying; Clause 17 governed by the law of Ireland; Clause 18(b) selecting the courts of Ireland; Annex I to the SCCs populated by Annex I of this DPA (the Customer being the data exporter and OmnionAI the data importer, with the contact details in Section 16); Annex II to the SCCs populated by Annex II of this DPA; and Annex III (where applicable) populated by the Subprocessor table in Section 8. Where the UK GDPR applies, the UK Addendum is incorporated and applies to that Personal Data, with Tables 1 to 3 populated from this DPA and Table 4 selecting "neither party." Where Swiss law applies, the SCCs apply with references construed to give effect to the Swiss Federal Act on Data Protection, and the competent authority is the Swiss Federal Data Protection and Information Commissioner. In the event of a conflict between the SCCs or the UK Addendum and the rest of this DPA, the SCCs or UK Addendum prevail for the Personal Data they cover.

The Service is currently offered to customers in Canada and the United States. OmnionAI does not target the EEA or the United Kingdom, and the transfer mechanisms in this Section apply only where the parties have expressly agreed in writing to Processing of EEA or UK Personal Data.

11. Personal Data Breach notification

OmnionAI will notify the Customer without undue delay, and in any event within seventy-two (72) hours, after becoming aware of a Personal Data Breach affecting Personal Data Processed on the Customer’s behalf. Notice will be given by email to the Customer’s account contact and will describe, to the extent known at the time: the nature of the breach and, where possible, the categories and approximate number of Data Subjects and records concerned; the likely consequences; the measures taken or proposed to address it and to mitigate its effects; and a contact point for further information. Where the full picture is not available within that period, OmnionAI will provide information in phases without further undue delay. OmnionAI will take reasonable steps to contain and remediate the breach, will preserve relevant evidence, and will cooperate with the Customer’s own investigation and notification obligations.

As between the parties, the Customer is responsible for determining whether a breach is notifiable to a Supervisory Authority, a Privacy Commissioner, or affected individuals, and for making those notifications. OmnionAI will not notify any third party about a breach as being one affecting the Customer’s Personal Data, or name the Customer in a notification, without first consulting the Customer, unless legally required to do so. OmnionAI’s notification of a breach is not an acknowledgement of fault or liability.

12. CCPA / CPRA service-provider terms

This Section applies to Personal Data that constitutes personal information of a California Consumer, and is intended to satisfy the CCPA’s requirements for a contract with a Service Provider. The Customer is the Business and OmnionAI is a Service Provider. Personal information is disclosed to OmnionAI solely for the limited and specified Business Purpose of providing the Service as described in the Agreement and Annex I. OmnionAI:

• will not Sell or Share personal information, as those terms are defined in the CCPA, for monetary or other valuable consideration, and receives no such consideration for it;
• will not retain, use, or disclose personal information for any purpose other than performing the Business Purpose specified in the Agreement, including outside the direct business relationship between OmnionAI and the Customer, except as permitted by the CCPA;
• will not combine personal information received from or on behalf of the Customer with personal information it receives from or on behalf of any other person, or collects from its own interaction with a Consumer, except as expressly permitted by the CCPA;
• will not use personal information to build or enrich any profile, product, dataset, benchmark, or model, and specifically will not use call content, transcripts, or extracted fields to train, fine-tune, evaluate, or improve any artificial-intelligence or machine-learning model, whether its own or a third party’s;
• will comply with the obligations applicable to it under the CCPA, will provide the same level of privacy protection as the CCPA requires of a Business, and will notify the Customer promptly, and in any event within five (5) business days, if it determines it can no longer meet those obligations; and
• grants the Customer the right, on notice, to take reasonable and appropriate steps to stop and remediate any unauthorised use of personal information, in accordance with Section 6.

Any engagement of a Subprocessor to Process such personal information will be under a written contract imposing these same restrictions.

No independent right of use; not a party to Caller communications. For the avoidance of doubt, and as a binding term rather than a description of current practice: OmnionAI Processes Caller Personal Data, call content, and communications transmitted through the Service solely as the Customer’s Processor and Service Provider, for the sole purpose of delivering the Service to the Customer. OmnionAI has no independent right — and by this DPA expressly and irrevocably disclaims any capability, licence, or authority — to access, read, listen to, retain, analyse, disclose, monetise, or otherwise use the content of any Caller communication for its own purposes, for the purposes of any other customer, or for any purpose other than providing the Service to the Customer under its instructions. This restriction applies to the content and to any derivative of it, including transcripts, summaries, extracted fields, embeddings, and aggregate outputs that are not fully de-identified. It binds OmnionAI, its personnel, and each Subprocessor, and survives termination. OmnionAI is not, and does not act as, a party to or an independent recipient of the Caller’s communications; it functions solely as the Customer’s instrument for handling them.

13. Liability

Each party’s liability arising out of or related to this DPA, whether in contract, tort, or any other theory, is subject to the exclusions and limitations of liability set out in the Terms of Service, and any reference there to the liability of a party means the aggregate liability of that party under the Agreement and this DPA together. This Section does not limit either party’s liability to a Data Subject under the third-party-beneficiary provisions of the SCCs where those apply, nor any liability that cannot be limited under applicable law.

14. Term and termination

This DPA takes effect on the effective date of the Agreement and continues until the Agreement expires or terminates and OmnionAI has completed the return or deletion required by Section 9. Provisions that by their nature should survive — including Sections 5 (confidentiality of personnel), 9, 10, 11, 12, 13, and this Section — survive termination. Termination of this DPA does not by itself terminate the Agreement.

15. Governing law and general

This DPA is governed by the laws of the Province of Ontario and the federal laws of Canada applicable therein, and the parties submit to the exclusive jurisdiction of the courts located in Toronto, Ontario, consistent with the Terms of Service — except that, where the SCCs or the UK Addendum apply, the governing law and forum they specify apply to claims under them. If any provision of this DPA is held invalid or unenforceable it will be limited or severed to the minimum extent necessary and the remainder remains in force. OmnionAI may update this DPA on prospective notice where required to reflect a change in Data Protection Laws, in Subprocessors, or in the Service, provided no update materially reduces the protections it affords; the current version is always published at this address.

16. Contact

Privacy and data-protection enquiries, Data Subject request assistance, and breach contact: 1001660987 Ontario Inc., privacy@omnionai.tech.

Annex I — Details of Processing

A. Parties. Data exporter / Controller / Business: the Customer identified in the Agreement. Data importer / Processor / Service Provider: 1001660987 Ontario Inc. (OmnionAI), an Ontario corporation, contact as in Section 16. Activities relevant to the transfer: receipt and handling of inbound calls and messages on the Customer’s behalf, and provision of the associated dashboard.

B. Categories of Data Subject.

• The Customer’s personnel and authorised users of the dashboard, and the Customer’s designated notification recipients.
• Callers — individuals who call, are called by, or exchange messages with a number answered by the Service. These are typically the Customer’s customers, prospective customers, suppliers, and other business contacts, and may include any member of the public who dials the number.
• Individuals named or described by a Caller during an interaction, or named in knowledge-base content the Customer uploads.

C. Categories of Personal Data.

• Account and user data: name, business name, email address, password in hashed form, role and membership, dashboard preferences and configuration.
• Communications metadata: caller and called telephone numbers, call direction, start and end time, duration, outcome and status, and message delivery records.
• Call content: the text transcript of the interaction and the AI-generated summary. Call audio is not recorded or retained (Section 7).
• Information a Caller provides during an interaction: typically name, callback number, email address, reason for calling, service address or location, appointment date and time, and free-text notes — and, unavoidably, whatever else a Caller volunteers in their own words.
• Derived data: AI-extracted structured fields, lead and booking records, and vector embeddings of Customer-supplied knowledge-base content used for retrieval.
• Calendar data (only where the Customer connects Google Calendar): event times, titles, attendees, and availability for the connected calendar.
• Billing contact data for the Customer: plan, subscription status, and limited card metadata such as brand and last digits. Full payment card numbers are handled by Stripe and are not received or stored by OmnionAI.
• Operational logs: IP address, timestamps, request and error records needed to run and secure the Service.

D. Special categories. None are requested, required, or intended, and the Customer undertakes in Section 4 not to submit them or configure the Service to elicit them. Because a Caller speaks freely, sensitive information may nonetheless be volunteered and captured in a transcript; where that occurs it is handled under the same measures as all other Personal Data and is subject to the same retention and deletion.

E. Nature and purpose of the Processing. Receiving and answering telephone calls and messages on the Customer’s behalf; real-time speech recognition and speech synthesis to conduct the conversation; transcription; AI extraction of structured fields and a summary from the transcript; retrieval from the Customer’s knowledge base to answer questions; creating leads, messages, and appointment bookings; delivering notifications to the Customer by email and SMS; writing appointments to a connected calendar; displaying all of the above in the Customer’s dashboard and the in-dashboard assistant; storage, backup, security, abuse prevention, support, and troubleshooting; and metering usage for billing.

F. Frequency. Continuous, on an ongoing basis for the term of the Agreement.

G. Duration. For the term of the Agreement, plus the retention window applicable to the Customer’s plan (or any shorter period the Customer configures), plus the post-termination return or deletion period in Section 9, plus any period required by law.

H. Subprocessors. As listed in Section 8, each processing for the duration and purpose stated there.

I. Competent Supervisory Authority (where the SCCs apply): determined in accordance with Clause 13 of the SCCs.

Annex II — Technical and organisational measures

OmnionAI implements and maintains the measures below. They are described accurately and are limited to controls that are actually in place; the Customer should not infer any control that is not listed. OmnionAI may update these measures provided the overall level of security is not materially reduced.

• Encryption in transit. All connections between the Customer’s browser and the Service, and between the Service and its Subprocessors, use TLS. Real-time media is carried over the encrypted transport provided by the voice infrastructure.
• Credential protection. User passwords are never stored in plaintext or reversibly. They are hashed with scrypt using a per-user random salt, and verification uses a constant-time comparison.
• Session management. Sessions use high-entropy opaque random tokens that carry no user data. Only a SHA-256 hash of the token is stored, so the session table cannot be used to impersonate a user if it is read. Sessions carry a fixed expiry and are deleted on logout.
• Tenant scoping on every query. Every data access is scoped to a single tenant at the application layer, with the tenant identifier bound to the database transaction and applied to the queries executed within it. A separate, minimally used connection path exists for cross-tenant operational jobs (such as routing an inbound number to the correct tenant and billing rollups) and is not reachable from customer-facing request handlers.
• Timing-safe secret comparison. Administrative and operational tokens are compared using constant-time comparison, so that response timing does not disclose how much of a presented secret is correct.
• Signature-verified webhooks. Inbound webhooks from the payment processor and the telephony carrier are rejected unless their cryptographic signature verifies against the shared secret, and verification fails closed if the secret is not configured. This prevents forged billing and call events.
• SSRF allowlist on outbound fetches. Any outbound HTTP request to a tenant-supplied URL (for example knowledge-base ingestion from a website, or an outbound integration endpoint) is checked against a guard that resolves the destination and refuses loopback, private, link-local, carrier-grade NAT, and cloud metadata addresses, including their IPv6-embedded forms.
• Rate limiting. Authentication, public, and abuse-prone endpoints are rate limited by a durable, atomic counter shared across application instances, so limits hold across restarts and horizontal scaling.
• Least-privilege vendor credentials. Subprocessor API keys are scoped to the minimum permissions the integration requires, are held as environment secrets in the hosting platform rather than in source control, and are not exposed to the browser.
• Database and query hygiene. All database access uses parameterised queries. Statement and idle-transaction timeouts are enforced so a single query cannot hold locks or connections indefinitely.
• Managed infrastructure. Hosting, operating-system patching, and database backups are provided by the hosting platform (Render) under its own security programme. Backups are managed by that platform.
• Retention enforcement. A scheduled job purges transcripts and related call data once the applicable retention window has passed, enforcing the Customer’s configured retention rather than relying on manual deletion.
• Access control and confidentiality. Production access is restricted to the small number of personnel who require it, is authenticated individually through the hosting platform, and every person with access is bound by confidentiality obligations.
• Disclosure discipline. Personal Data is not disclosed to any third party other than the Subprocessors listed in Section 8, except as required by law.