Trust Center
DialPhone carries customer conversations, calls, messages, recordings, AI summaries, across US & Canada countries. Security, privacy, and reliability are not features. They are the floor.
The programme below describes the controls DialPhone operates and the documents it will provide on request. It is not itself evidence: for each item, ask for the artifact, its scope and its validity dates, and verify any authorization in the relevant official registry. SOC 2 Type II audits the operating model, ISO 27001 audits the information-security management system, HIPAA BAA covers protected health information, GDPR with EU data residency covers European personal data, PCI DSS covers payment-card-over-phone within a defined assessed scope, FINRA and SEC 17a-4 cover broker-dealer recording retention, CCPA / CPRA covers California consumer rights, and STIR/SHAKEN A-level attests outbound caller ID against carrier robocall mitigation.
Four operational pillars carry that floor day-to-day: security (seven-layer defense, 24/7 SOC), privacy (no sale of data, no model training without opt-in), reliability (99.999% contractual uptime with service credits), and responsible AI (human-in-the-loop, audit logs per AI decision, complete opt-out).
Seven-layer defense: end-to-end encryption, private cloud hardening, real-time threat detection, penetration testing, bug bounty, SIEM, 24/7 NOC.
Customer data is processed for service delivery only. No secondary use, no training AI models on customer calls without explicit opt-in.
99.999% monthly uptime target with service credits across voice, meetings and contact center. Redundant data centers, active-active failover, geo-diverse carrier routes.
Human-in-the-loop by default, transparent model disclosures, bias testing, customer data never used to train shared models.
Every control below is audited by an accredited third party on a repeating cycle. Reports and letters are available to customers and qualified prospects under NDA.
Contact DialPhone for current status, scope and documentation
BAA available on Advanced and Ultra plans
EU data residency, full DPA, subprocessor registry
Contact DialPhone for current status, scope and documentation
Retention capabilities. Contact DialPhone for status and scope
California consumer data rights honored globally
Contact DialPhone for current status, scope and documentation
Caller-ID attestation for US outbound
If you believe you’ve found a security issue, we want to hear from you. Researchers acting in good faith are protected under a safe-harbor policy.
Yes. DialPhone is audited annually to SOC 2 Type II across Security, Availability, Confidentiality, and Processing Integrity. The full report is available under NDA, request a copy.
Customers on Advanced, Ultra, and all Contact Center tiers receive a BAA at no additional cost. Email support@dialphone.com with subject "BAA request" to e-sign. See the HIPAA page for covered features and technical safeguards.
US customers in US regions (Virginia, Oregon). EU customers in EU regions (Frankfurt, Dublin) with EU-only data residency. Data never crosses region boundaries unless the customer explicitly enables cross-region replication.
99.999% monthly uptime, contractual, with service credits for breach. The public status page reports real-time and historical incidents.
No, not without explicit opt-in. Shared foundation models are pretrained before customer data exists. Optional fine-tuning uses only data that the customer opts in per workspace, and that data never blends with other customers' data.
Email support@dialphone.com (PGP key on this page) or submit via our coordinated disclosure portal. Acknowledgement within 24 hours, triage within 3 business days, rewards for in-scope findings.
Yes, the full subprocessor registry is public and updated whenever we add or remove a vendor. Existing customers are notified 30 days in advance of any change.
No. DialPhone is not FedRAMP authorized and does not appear in the FedRAMP Marketplace. Where a procurement requires FedRAMP, DialPhone does not currently meet it. Read the roadmap, and verify any vendor status in the official registry.
Export tools let you download recordings, messages, and call history anytime. After cancellation, data is retained for 30 days (in case you reinstate), then permanently deleted from primary storage and within 90 days from backups. Certificates of destruction available on request.
Trust Center