This policy explains how OmertaCall LLC approaches security, privacy and governance for AI-enabled communications. It applies to AI voice agents, transcription, translation, call scoring, compliance review and live coaching, together with the telephony, analytics and integration services that support them. Contractual commitments are set out in the customer's agreement and Data Processing Addendum.
1. Governance and accountability
OmertaCall maintains an information-security governance framework for AI services. Responsibilities cover risk assessment, policy ownership, access review, supplier oversight, incident management and staff awareness. AI features are assessed before material changes so that privacy, security and intended-use risks are considered alongside product requirements.
Our control environment is aligned with ISO 27001 and SOC 2 controls. OmertaCall's broader compliance posture includes SOC 2 Type 2, ISO 27001, ISO 22301, ISO 9001, PCI DSS, HIPAA, GDPR with a DPA, POPIA and Cyber Essentials. Alignment or status under one framework does not remove a customer's own compliance obligations.
2. Data minimisation and purpose limitation
We limit AI processing to the information needed for the configured feature and documented customer instructions. Customers should disable unnecessary collection, avoid placing sensitive information in free-text fields and choose retention settings appropriate to their purpose. Access to an integration or tool should be limited to the data and actions the workflow requires.
Call recordings, transcripts and other customer data are not used to train third-party foundation models without customer consent. Data supplied for transcription, translation, scoring or coaching is processed to deliver that function, protect the service and provide support—not to create a general-purpose training corpus.
3. Access controls and administrative safeguards
Access to customer information is governed by role-based permissions and the principle of least privilege. Administrative actions and support access are subject to authorisation and logging. Personnel with access are bound by confidentiality obligations and receive security and privacy awareness appropriate to their role.
Customers control their own user provisioning and must protect credentials, enable available account safeguards, promptly remove obsolete users and restrict campaign, recording and integration permissions. Production, development and test activities are separated to reduce the chance that live customer information is used outside its authorised purpose.
4. Encryption and communications security
OmertaCall calls are encrypted, with SIP signalling over TLS and media protected by SRTP. Information transmitted to supported service interfaces is protected using encrypted connections, and stored information is protected through platform encryption controls. Encryption is combined with access restrictions, secrets management and controlled operational access rather than treated as a standalone safeguard.
Customers are responsible for securing their own devices, networks, endpoints and third-party systems. A secure connection to OmertaCall cannot protect information after a customer exports it or sends it to an integration under the customer's control.
5. Model and provider due diligence
AI models and specialist processing providers are reviewed for their security posture, data-use terms, processing locations, retention practices and contractual protections before use and when material changes occur. Provider access is limited to the information needed for the requested operation. Contracts or service terms must prohibit training third-party foundation models on customer data without the required consent.
We assess changes in provider capabilities and restrictions as part of supplier risk management. Where legally required, customer authorisation and international-transfer safeguards are put in place before personal information is processed by a provider.
6. AI lifecycle and output controls
AI workflows are configured for defined business purposes and tested before release. Prompts, tools, models and integrations are subject to change control. Safety measures can include constrained tool permissions, bounded instructions, input and output checks, human hand-off and the ability to disable a workflow.
AI output may be wrong, incomplete or unsuitable for the situation. Customers must maintain human oversight and independently review consequential decisions. OmertaCall does not treat an AI score, translation or recommendation as a substitute for professional judgement or legal compliance review.
7. Logging and monitoring
Security and operational monitoring is used to identify unusual access, abuse, service disruption and workflow failures. Audit records support investigation and accountability, with access restricted to authorised personnel. Logs are retained according to operational, contractual and legal requirements and are protected against unauthorised alteration or disclosure.
Available webhooks and integrations can support a customer's monitoring arrangements. Customers remain responsible for reviewing alerts, protecting exported logs and configuring their own security tools.
8. Incident response
OmertaCall maintains procedures to triage, contain, investigate and recover from security incidents. Responsibilities and escalation routes are established in advance, and lessons from incidents feed back into controls and testing. Evidence is preserved where needed for investigation and legal obligations.
Where OmertaCall acts as a processor, we notify the affected customer of a confirmed personal-data breach without undue delay and provide information reasonably available to support the customer's assessment and notification duties. Contractual notification periods, including any applicable 72-hour commitment in a DPA, govern the response. A notification does not constitute an admission of fault.
9. Privacy, GDPR and regulated information
For customer content processed through AI features, the customer generally determines the purposes and means and acts as controller; OmertaCall acts as processor under documented instructions. Our DPA addresses confidentiality, security, data-subject request assistance, breach support, deletion or return, sub-processors and international transfers.
For EEA and UK personal information, applicable safeguards can include adequacy arrangements, EU Standard Contractual Clauses and the UK International Data Transfer Agreement or Addendum, supported by transfer assessments where required. POPIA obligations apply where relevant. Customers requiring HIPAA arrangements must request and execute an appropriate BAA before submitting protected health information.
Customers must provide required notices and obtain consent for recording, AI interaction, voice processing and any biometric use. Requests concerning customer-controlled data should normally be directed to that customer. OmertaCall provides reasonable assistance under the applicable agreement.
10. Resilience and continuity
Security planning includes backup, recovery and continuity controls appropriate to the service. OmertaCall's network uses 30+ edge nodes and is designed for resilient operation. Business-continuity controls are informed by ISO 22301. Customers should nevertheless maintain their own exports and fallback procedures for critical operations.
11. Customer security responsibilities
Customers must use AI features lawfully, configure access and retention carefully, supervise output and protect integration credentials. Fraud, unauthorised voice cloning, attempts to attack or bypass the platform, use of malicious inputs and training a competing model from OmertaCall output are prohibited. Customers must promptly report suspected misuse or compromise and cooperate with reasonable containment steps.
A customer's compliance depends on its configuration, data, users and calling practices. No policy or certification makes every customer deployment compliant automatically.
12. Policy review and contact
We review this policy when AI capabilities, suppliers, risks or legal obligations materially change. The current version is identified by the date above. For legal matters or questions about this policy, contact [email protected].
OmertaCall LLC, Hunkins Waterfront Plaza, Suite 556, Main Street, Charlestown, Nevis.