Security
What happens to a call, from ring to deletion.
Your callers say things to this agent that they would not put in a form. This page traces that audio: where it goes, which vendors touch it, how long it lives, and who can read it.
The short version
Four answers, before the detail
Data at rest
Sydney
AWS ap-southeast-2
In transit
TLS 1.2+
Every leg, every hop
Encryption
AES-256
Supabase managed Postgres
Model training
None
Bedrock retains nothing; speech vendors barred
Follow one call
Six stages, in the order they happen
01 · The call arrives
Audio lands on a Sydney machine
Inbound routing comes through Telnyx and the voice pipeline that answers runs on Fly.io in Sydney. The leg between the caller and us is TLS 1.2 or higher, as is every hop after it.
Nothing has been written down yet. The call exists as audio moving through a process in memory.
02 · It gets transcribed
Speech is processed in transit, not stored
Deepgram turns the caller's audio into text, and Cartesia or ElevenLabs turns the agent's replies back into speech. Both are reached over TLS, and both are under agreements that forbid training on what we send them.
Speech vendors hold the stream long enough to process it and no longer. If you need that boundary inside your own network, in-VPC speech deployment is available for enterprise and regulated customers on request.
03 · A model reads it
Inference runs in Sydney and keeps nothing
The default model runs on AWS Bedrock in ap-southeast-2. Bedrock does not store prompts and does not train on them, which is the reason it is the default rather than a cheaper endpoint offshore.
Operators can select a different model per agent. Choosing one of the optional providers sends conversation context to the United States, and /sub-processors names every one of them so that decision is made with the region in front of you.
04 · It gets written down
Redacted before it reaches the database
Every transcript line passes a redactor on the way to storage. It masks card numbers by Luhn check, Australian Tax File and Medicare numbers, and US Social Security numbers. A caller who reads their card out loud does not leave it in your transcript.
What lands is stored in Supabase Postgres on AWS ap-southeast-2, encrypted at rest with AES-256.
05 · Someone reads it
Only your workspace can, and the database enforces it
Every customer row carries a workspace_id behind a Row-Level Security policy resolved through user_workspace_ids(). Postgres applies it to every query, so a developer who forgets the filter still gets only your rows.
The service-role client that bypasses RLS is confined to server-side webhook and admin paths, and a build gate fails any pull request that reaches for it from client code.
06 · It gets deleted
You set the window
Pick 30, 90, 365 or 730 days. A daily job purges transcripts and session events past it. The default is 365 and enterprise contracts can opt out.
Ask for a deletion and personal data is hard-deleted within 7 days, inside the 30 days the Privacy Act and GDPR Article 17 allow. The audit log survives, and it carries no UPDATE or DELETE policy, so the record of who changed what cannot be edited afterwards.
Application controls
Each one is a line of code you could be shown
Transport
HSTS with preload
Two-year max-age, includeSubDomains, preload. A browser that has seen the apex once refuses to speak plaintext to it again.
CSRF
Origin checked on every write
checkSameOrigin() rejects cross-site POST, PATCH and DELETE on billing and organisation routes, over the top of SameSite=Lax cookies.
Webhooks
Signed, and replay-proof
Stripe webhooks are verified against the raw body. Accepted event IDs are recorded, so a replayed event short-circuits instead of double-charging.
Telemetry
PII stripped before it leaves
Request bodies on billing, webhook and auth routes are dropped before send. Cookie, authorization and stripe-signature headers are redacted on every event.
Transcripts
Redacted at persistence
Cards by Luhn check, Australian TFNs and Medicare numbers, US SSNs. Masked on the way into the database, not on the way out to a screen.
Retention
A window you choose
30, 90, 365 or 730 days, enforced by a daily Postgres job. Conversation messages and session events past the window are purged without anyone remembering to.
Rate limits
Per-IP caps on billing
Ten requests a minute per IP on portal, subscription and usage routes. Account export and deletion are tighter again.
Audit
Append-only by policy
audit_logs has no UPDATE and no DELETE policy. Billing, membership and configuration changes are written once, with actor, action, resource and diff.
Tenancy
RLS on every customer table
Policies scoped through user_workspace_ids() cover every table holding customer data. Cross-tenant reads are a schema impossibility, not a code review item.
Browser
Headers set tight
nosniff, X-Frame-Options DENY, COOP same-origin, Referrer-Policy strict-origin-when-cross-origin, and a narrow Permissions-Policy.
Secrets
Never in source control
Credentials live in the Vercel and Fly.io secret stores. Service-role keys are server-only and gated by an inline justification at the import.
Subject rights
Export and erasure on request
Email privacy@verticalai.com.au for a data export or account deletion. Requests run to a 7-day operational SLA; self-serve equivalents are rolling out.
Compliance
Where we stand on each framework
Self-assessed
PCI DSS SAQ-A
Card data never touches our servers. Stripe Checkout and the Customer Portal carry the whole PCI scope and we hold opaque Stripe IDs. SAQ-A is the mechanism for merchants who fully outsource cardholder data.
Self-attested
Privacy Act 1988 (Cth) and the 13 APPs
Compliant. There is no certifying body for the APPs; the OAIC publishes a self-assessment tool and we run our practices against it annually.
Compliant
Notifiable Data Breaches scheme
We notify the OAIC and affected individuals as soon as practicable once we have reasonable grounds to believe an eligible breach occurred, and assess a suspected one within 30 days. The runbook rotates Stripe and Supabase credentials, audits the affected window, and produces the written notice.
Self-attested
GDPR, Article 28 processor
Aligned. Standard DPA, published sub-processor list, self-serve export and erasure. No EU establishment, and data subject obligations honoured for EU customers.
Audit pending
SOC 2 Type II
Controls implemented and mapped to the Trust Services Criteria. The independent audit has not been done. We engage Vanta or Drata when the first enterprise contract calls for it.
Audit pending
ISO/IEC 27001:2022
Annex A controls aligned, roughly 70% overlapping SOC 2. Certification follows the same cadence. Relevant to EU and UK expansion under NIS2.
Mapped
Essential Eight (ASD)
Six of eight fully met inside a cloud-native scope, one partially met (restore drills are documented, the quarterly cadence is still ramping), one not applicable (Office macros). Per-control evidence on request.
Out of scope
HIPAA, IRAP, APRA CPS 234
HIPAA needs sub-processor BAAs and sits on the enterprise roadmap. IRAP covers Australian government workloads only. CPS 234 is designed for, with formal alignment on request for APRA-regulated customers.
FAQ
What security reviews ask us
Can a caller's recording leave Australia?
Do you train on our calls?
Who inside my company can read a transcript?
What if a caller reads out their card number?
Are you SOC 2 certified?
How long do you keep the data, and can I change that?
Can I sign our own DPA?
Send this to your security reviewer.
The DPA covers GDPR Article 28 and APP 8. Tell us your entity name and any regime that applies, and we reply within two business days.