Security and privacy
Your customers’ calls are sensitive data. This is how we protect them.
This is the summary customers, legal advisors and IT teams usually ask us for. The full detail lives in the privacy policy and terms, and if you need more, we are happy to answer.
At a glance
The short version
- Hosting
- Data centers in the European Union
- Encryption
- All stored data is encrypted, with a second layer for transcripts, summaries and credentials
- Connections
- HTTPS on every connection to the platform
- Isolation
- Each customer in a separate workspace, with no access between customers
- Sign-in
- Two-factor authentication and role-based permissions
- Privacy
- Israeli Privacy Protection Law (including Amendment 13) and GDPR, with a DPA for customers who need one
Encryption
Your data is encrypted while it is stored
- The database, backups and stored files are encrypted with industry-standard encryption
- Transcripts, call summaries and details the agent collects get a second layer of encryption, bound to your workspace
- Credentials for the systems you connect, such as your CRM, are stored encrypted
- Passwords and API keys are stored only as hashes, so not even we can read them
Isolation and access
Your workspace is yours alone
- Every request is identified and scoped to your workspace, and there is no way to see another customer’s data
- You decide who on your team sees calls, who changes the agent and who manages connections, including custom roles
- Two-factor authentication (2FA) available to every user
- Protection against password guessing and bots on sign-in and sign-up
- Every change is written to an activity log, and actions the agent takes are kept in a tamper-evident log
Calls and recordings
Every call is recorded and protected
- The opening line we write for your agent tells callers the call is recorded, and you can edit it to fit what your business needs
- Recordings are stored encrypted and open only through a short-lived, secure link from inside your workspace
- Consents and opt-outs are recorded and enforced on later calls, and outbound calls go out only in the hours you set
- We do not use your calls or data to train AI models
Infrastructure
Enterprise-grade infrastructure
The infrastructure Direnium runs on belongs to providers that are independently audited. The cloud provider and the AI providers hold SOC 2 Type II and ISO 27001, and the voice engine provider holds SOC 2 Type II.
- The database and servers sit on a private network and are not reachable directly from the internet
- The database is replicated across multiple data centers, with automatic daily backups
- Secrets and keys are kept in a dedicated cloud vault, never in code
- Infrastructure access is logged, with automatic alerts on unusual activity
Your data
You own your data
- You can export all of your workspace data, and have contacts erased on request
- When you leave, we hand your data over and delete it from the platform
- We sign a Data Processing Addendum (DPA) and complete security questionnaires when your organisation needs them
- The list of subprocessors is published in the privacy policy and maintained there
Reporting
Found a security issue?
We want to hear about it. Write to us with as much detail as you can, and we will get back to you within one business day.
- security@direnium.com