SECURITY

Security built into every call.

Carrier-grade reliability and privacy by design — so you can run regulated voice and messaging workloads with confidence.

Our approach

Security and privacy are built into the Express IVR runtime, not bolted on. We apply least-privilege access, encryption, continuous monitoring and reasonable safeguards across the platform, and we design for the regulatory reality of Indian telecom and data protection.

Encryption

TLS in transit and encryption at rest for data in our control, with masking where appropriate.

Access control

Least-privilege access, SSO for enterprise accounts, and human-readable audit logs.

Data residency

Hosted in India with region-pinned processing for voice and messaging workloads.

Reliability

Multi-carrier failover and redundant infrastructure for carrier-grade uptime.

Monitoring

Continuous monitoring and anomaly detection, with incident response procedures.

Secure SDLC

Code review, dependency scanning and change control across our build pipeline.

Compliance & regulation

  • DPDP Act 2023 & DPDP Rules 2025 — we handle personal data as a Data Fiduciary and, for customer workloads, as a Data Processor, with consent, erasure and breach-notification practices aligned to the law. See our Privacy Policy.
  • TRAI TCCCPR / DLT — commercial communications are sent through registered headers and content templates on the operator DLT platform, with explicit-consent and DND handling.
  • Telecom licensing & GST — we operate through licensed telecom routes and compliant billing.
  • SOC 2 Type II & ISO/IEC 27001 — on our roadmap; controls are being formalised toward independent audit.
Certifications marked "on our roadmap" are in progress, not yet achieved. Please confirm current certification status with our team before relying on it in a contract.

Responsible disclosure

If you believe you've found a security issue, email [email protected]. We investigate every report, act quickly on valid findings, and will keep you updated. Please give us reasonable time to remediate before public disclosure.

Sub-processors

We use a vetted set of sub-processors (such as cloud hosting and telecom carriers) under contracts that require them to protect data. A current list is available to customers on request.

Reviewing Express IVR for a regulated workload?

Our team will walk your security and compliance checklist with you.

Email [email protected]