Security and GDPR

Secure by design. Because calls are a company's most sensitive data.

Recordings, transcripts and outcomes contain names, addresses, amounts and decisions. We treat them the way you would want: in the European Union, with retention you set, and without looking.

Data in the European Union

Application, database and recordings on a server in France. We download the recording from the carrier and delete it there. Location in Poland on request.

Fallback and monitoring

If the main server doesn't answer within 5 seconds, an independent responder in another cloud forwards the call to the dispatch desk. Plus an availability check every 5 minutes and a test call every hour.

Customer isolation

Every company sees only its own data. Isolation is enforced by the database (Row Level Security), not just the application code. Recording retention is set in the agreement.

Verification without a trace

Codes and passwords spoken during a call never reach the recording, transcript or system logs.

Audit log

Every recording playback, every priority change, every login: who and when. Visible to the company's administrator.

Recording announcement

An announcement at the start of every call, referring to the privacy policy. We agree the wording with you.

Roles and agreements

Who is who under the GDPR.

Your company is the controller of the call data: it decides that calls are recorded, why, and how long they are kept. TidyVox is a processor acting under a data processing agreement, only within the scope you commission.

The sub‑processors we use are listed in the agreement, with a change‑notification rule and a right to object: an EU‑based telecom carrier for numbers and calls, a language‑model provider for summaries and outcomes, which receives only the transcript text and does not train models on it, and hosting in the European Union.

Documents available before onboarding: the data processing agreement template, the sub‑processor list, a description of technical and organizational measures, proposed wording for the recording announcement and the privacy notice for your customers.

What we don't do

Four commitments that are in the agreement.

We don't train models on your calls. Neither we nor our providers. The transcript serves your service only.

We don't listen to customers' calls. Only your users have access to recordings. Our access requires your consent and is logged in the audit trail.

We don't spoof caller IDs. When transferring calls the customer always sees your company's number, never a caller's number presented as our own.

We don't decide for humans. Every outcome, priority and alarm waits for an employee's click. The model proposes, it doesn't act.

Ask for the documents before onboarding.

The data processing agreement, the sub‑processor list and the security measures in one package.

Request the documents