Where call data goes and who can reach it

Written for the person at your firm who has to approve this: the data path, the controls on it, and what happens when you ask for it back.

The path

Where a call actually goes

Phone network to voice platform: The call arrives over the phone network at the voice platform that runs the agent. Audio is encrypted in transit.
Voice platform to a private server: Call events go to a server that runs only this work. The automation does not run on a shared, general purpose platform alongside other people’s workflows.
Private server to your system: The record is written into your own case management system. No third party automation cloud sits between the call and your system.
Recordings at rest: Call recordings are stored in a private, encrypted, versioned bucket, separated per client. They are not held in a shared folder alongside another firm’s calls.

The controls

Encryption: Data is encrypted in transit and encrypted at rest.
No retained payloads on success: When a workflow run completes successfully, it retains no caller data payload. The record lives in your system, not in the automation’s run history.
Signature verified webhooks: Every incoming webhook is signature verified before anything acts on it. Unsigned or badly signed requests are rejected.
Recording disclosure: The disclosure is spoken on every call as part of the greeting. It is not a setting that can be switched off per call.
Text message consent: Text messages go out only after the caller has said yes on the recording. The consent and the recording sit on the same record.
Deletion: Call data is deleted on request, and on termination of the agreement.

Your firm owns its data. You can ask for a full export or a deletion at any time, and neither request requires a reason.

Free walkthrough

If something here needs to be tighter for your carrier or your policy, say so on a call and we will go through it.