Security & Compliance
SquawkVoice is built for enterprise deployment from the ground up. Our infrastructure, compliance posture, and data practices meet the requirements of regulated industries including healthcare, financial services, and retail.Request SOC 2 Report
Available under NDA. Contact us to request the full independently-audited report.
Security Questionnaire
We complete VSA, SIG, CAIQ, and custom questionnaires for enterprise reviews.
Architecture Review
Schedule a call with our engineering team to walk through infrastructure and data flows.
Certifications & Compliance
SOC 2 Type II
Independently audited. Our security controls have been verified to operate effectively over an extended audit period — not just at a point in time.
HIPAA Compliant
Business Associate Agreements are executed with all subprocessors that handle protected health information. Customer BAAs available upon request.
GDPR Compliant
SquawkVoice complies with GDPR requirements for data processing, privacy rights, and lawful basis of processing personal data.
Security Controls
The following controls are drawn from our SOC 2 Type II audit. Green status indicates the control was verified as operating effectively during the audit period. To request the full audit report, contact security@squawkvoice.ai.
Legal & Policies
Terms of Service — published at squawkvoice.ai/terms-conditions
Privacy Policy — published at squawkvoice.ai/privacy-policy
Subprocessor List — published and maintained at squawkvoice.ai/subprocessor-list
Incident Response Policy — documented and tested
Risk Management Policy — formally documented
Software Development Lifecycle Policy — documented
Vulnerability Disclosure Policy — active, contact security@squawkvoice.ai
Access Control
Role-Based Access Control (RBAC) — enforced across all platform layers
Multi-Factor Authentication — required for all internal staff on production systems
Least Privilege Principle — access scoped to job function, reviewed on role change
Password Security — Studio requires a password of at least 8 characters when you sign up, change your password or reset it
Access Logging — all access events logged and auditable
Vendor Access Controls — subprocessors bound by DPAs with scoped access
Access Review — periodic access reviews conducted
Data Security
Encryption in Transit — TLS 1.2+ enforced on all data in motion
Encryption at Rest — AES-256 on all stored data including recordings and transcripts
Data Erasure — automated deletion after the 60-day default retention window
Multi-Tenant Isolation — logical data separation; cross-tenant access is not possible
No Financial Data Retained — Stripe handles payments via tokenization; no card data stored
Data Classification — customer data classified and handled per sensitivity level
Infrastructure Security
Separate Production Environment — production isolated from development and staging
Google Cloud Platform — SOC 2, ISO 27001, and FedRAMP certified infrastructure
Anti-DDoS — GCP native DDoS protection enabled
Firewall — network-level firewall rules enforced across all environments
Virtual Private Cloud — all services deployed within a private VPC
Infrastructure Security — hardened OS images, automated patch management
Multi-Zone Redundancy — automatic failover across GCP availability zones
Network Security
Virtual Private Cloud — all services isolated within private network segments
Firewall Rules — least-privilege network access enforced
Wireless Security — all internal network access requires authentication
Traffic Monitoring — anomalous traffic patterns trigger automated alerts
Application Security
Web Application Firewall — WAF enabled on all public-facing endpoints
Vulnerability & Patch Management — automated scanning with remediation SLAs
Credential Management — secrets managed via GCP Secret Manager; no hardcoded credentials
Secure Development Lifecycle — security review embedded in engineering process
Dependency Scanning — third-party dependencies scanned for known vulnerabilities
Product Security
Sign-In Options — email and password, or Google sign-in
Audit Logs — a record of configuration changes and billing events, available in the dashboard. See Audit Logs
Tenant-Scoped Access Control — account users can see and change only the data of their own account
AI Disclaimers — a per-agent AI disclaimer for the chat widget and for email agents; voice agents can disclose in their greeting
Data Retention — 60-day default for call recordings and transcripts; contact support if you need a shorter window
Availability & Reliability
99.9% Uptime SLA — committed availability backed by GCP infrastructure
Automated Failover — multi-zone architecture with no single point of failure
Incident Response — documented response plan with defined escalation paths
Monitoring — 24/7 infrastructure and application monitoring with alerting
Infrastructure
Google Cloud Platform
All SquawkVoice infrastructure runs on GCP in US-based data centers. GCP is SOC 2, ISO 27001, and FedRAMP certified — your data never leaves enterprise-grade infrastructure.
99.9% Uptime SLA
We commit to 99.9% platform availability. Multi-zone redundancy with automatic failover is enabled by default across all customer accounts.
Encryption in Transit
All data in motion is encrypted using TLS 1.2 or higher. No unencrypted transmission occurs at any point across the platform or between subprocessors.
Encryption at Rest
All stored data — call recordings, transcripts, and metadata — is encrypted at rest using AES-256.
Data Handling & Privacy
SquawkVoice never sells, licenses, or shares your data with third parties for any commercial purpose.
Data Retention
- Default retention for call recordings and transcripts is 60 days, after which data is permanently deleted
- Customers may request a shorter retention window at any time — contact support@squawkvoice.ai
- Other kinds of data follow their own retention schedules. Audit log entries, for example, are kept for a limited period of their own — see Audit Logs. To confirm the period that applies to a specific kind of data, contact security@squawkvoice.ai
Financial Data
SquawkVoice does not retain any financial information. Payments are processed exclusively by Stripe using tokenized data. We never see, store, or transmit credit card numbers or bank account details.
Multi-Tenant Isolation
Each customer’s data is logically isolated from all other customers. Cross-tenant data access is architecturally impossible at every layer of the stack.Call Data & Audit Logs
Full Conversation Logs
All interactions — call recordings and full transcripts — are logged and accessible in real time via the SquawkVoice dashboard.
Audit Trails
Detailed audit trails of all data access events are maintained. Enterprise customers can request audit log export for compliance reviews.
Call Metadata
Caller ID, duration, outcomes, and routing metadata retained alongside transcripts for full operational visibility.
Real-Time Access
Call data is available in your dashboard immediately after each interaction — no lag, no batching.
AI Transparency & Disclosure
AI disclosure is set per agent, and the way you set it depends on the channel. For a voice agent, write the disclosure into its Greeting message (on the Greeting & Sign-off card, Voice tab) so the agent identifies itself as AI at the start of the call, per your internal governance or regulatory requirements. Voice agents have no separate disclosure setting. See AI Agents. Email agents disclose AI by default. Every email agent ends the replies it writes with a short AI disclaimer, “This email was generated by AI. Verify important information”, with nothing to switch on. You can reword it or switch it off per agent in Email Configuration → Config; there is no account-wide setting for it. See Email Agents for which emails carry it. The chat widget has its own, separate AI Disclaimer, set per agent in Chat Configuration → Customize Widget — see Chat Widget.Subprocessors
Our full subprocessor list is published and maintained at squawkvoice.ai/subprocessor-list. Customers are notified of subprocessor changes per our standard notification policy.All subprocessors are bound by data processing agreements. SquawkVoice conducts periodic reviews of subprocessor security posture.
Business Associate Agreements (BAAs)
For customers in regulated industries subject to HIPAA, SquawkVoice executes Business Associate Agreements as required. BAAs are in place with all subprocessors that may handle protected health information — including Twilio, Deepgram, ElevenLabs, OpenAI, and GCP.To request a BAA for your organization, contact security@squawkvoice.ai.
Incident Response
1
Detection
Security events monitored continuously via GCP native tooling and internal alerting. Anomalous access patterns trigger immediate investigation.
2
Containment
Upon confirmed incident, affected systems are isolated and access revoked within minutes. Documented response policy with defined escalation paths and decision owners.
3
Notification
Affected customers notified promptly and within timeframes required by applicable law — including HIPAA’s 60-day breach notification and GDPR’s 72-hour supervisory authority notification.
4
Remediation & Review
Root cause analysis conducted after every incident. Findings used to update controls. Summary available to affected customers upon request.
Vulnerability Disclosure
We welcome responsible disclosure of security vulnerabilities. Contact security@squawkvoice.ai with:- Description of the vulnerability and potential impact
- Steps to reproduce
- Supporting evidence (screenshots, logs, etc.)
Enterprise Security Reviews
SOC 2 Type II Report
Available under NDA. Contact us to request a copy for your vendor review process.
Security Questionnaires
We complete VSA, SIG, CAIQ, and custom questionnaires for enterprise customers and prospects.
Architecture Review
Schedule a call with our engineering team to walk through infrastructure, data flows, and integrations.
Custom DPA
Data Processing Addenda available for customers with specific contractual requirements.
Additional Resources
Privacy Policy
Full privacy policy including data subject rights and lawful basis for processing.
Subprocessor List
All authorized subprocessors, published and maintained in real time.
Terms of Service
Standard terms of service governing platform use.