Security and data handling

Security and data handlingConfirmly AI answers phone calls, so it handles what callers say. Below is every provider in the path, what each can see, and where it runs.Sub-processors

Google Cloud (Firebase App Hosting) — Runs the application and database connections, and handles sign-in. Sees: Everything the service stores, at rest and in transit. Region: United States (us-east4)

Neon — Managed PostgreSQL: the primary datastore. Sees: Accounts, business configuration, call records, transcripts, summaries and contacts. Region: United States

Cartesia — The voice runtime: speech recognition, speech synthesis, turn-taking and telephony. Sees: Live call audio and the transcript of the conversation, while the call is happening. Region: United States

Groq — Language-model inference: what the receptionist decides to say. Sees: The conversation text and the business configuration for that call. Region: United States

Telnyx — Phone number provisioning and SIP routing. Sees: Phone numbers and call routing metadata. Not conversation content. Region: United States

Twilio — Alternative phone number vendor, where a number is provisioned there. Sees: Phone numbers and routing metadata. Not conversation content. Region: United States

Stripe — Subscription and usage billing. Sees: Billing identifiers and payment status. Card numbers go to Stripe directly and never reach us. Region: United States

Resend — Transactional email: sign-in links and call notifications. Sees: Recipient addresses, and the call summary content you have chosen to be emailed. Region: United States

Tavily — Reads your own public website when you train your receptionist on it. Sees: Public pages of the website you point it at. No caller data, ever. Region: United States

Google Calendar — Optional, and only if you connect it: availability and booking. Sees: Free/busy times, and events the receptionist creates. Event titles, attendees and descriptions are never received. Region: United States

What is in place

Transport encryption, server-side tenant isolation, signed webhooks, scoped short-lived access tokens and least-privilege credentials.

A retention window you set yourself: transcripts, recordings and summaries older than it are removed automatically.

Export and deletion of your call and contact data, on demand, from your own account.

No training of shared or third-party models on your data. Data from a connected Google account is never used for training of any kind.

Card details never reach our servers.

A recorded-call notice the receptionist can be configured to speak to callers.

What we do not have

HIPAA — We do not currently sign Business Associate Agreements and the service is not certified for protected health information. If your calls would carry PHI, talk to us before you buy rather than after.

SOC 2 — No SOC 2 report exists today. The controls above are real; the independent audit of them is not yet done.

Data residency outside the United States — Every sub-processor above runs in the United States. If your obligations require regional residency — Saudi PDPL, UAE, EU GDPR transfer rules — we cannot meet that today, and no amount of contract language changes where the processing happens.