Workspace access & permissions
Role-based access control across company, department and call-flow scope. Every privileged action is attributable to a named user.
Trust Center
Built for secure, auditable voice operations
Enterprise voice touches your customers, your systems and your regulator. Here is exactly how VartaVoice and the VARTA engine keep those conversations controlled, compliant and provable.
- ISO 27001Certified ISMS
- AES-256Encryption at rest
- 24 hrsBreach notification
- In-memoryConversation processing
Operational controls
The controls your operations team actually uses
Security is not only a certificate. These are the day-to-day controls built into the product.
Complete call records
Transcript, summary, detected intents, actions fired and integration responses — retained for exactly as long as your policy allows.
Configurable data flows
Decide what is stored, what is redacted and what never leaves memory. PII masking rules apply before persistence.
Human handoff
Escalation triggers on sentiment, intent, guardrail trips or explicit request, with full context handed to the agent.
Post-call review workflows
Negative-sentiment and flagged calls route into a review queue that feeds agent reconfiguration.
Safe testing before deployment
Simulate flows against synthetic callers and inspect the full trace before a single real number is dialled.
India compliance
TRAI, DLT, DPDP and RBI — enforced by the platform
Compliance that depends on campaign discipline eventually fails. These rules are enforced in the runtime.
- 01
DND / NCPR scrubbing
Outbound lists are scrubbed against Do-Not-Disturb and preference registries before dialling, per campaign.
- 02
DLT template workflows
Registered sender IDs and approved templates for the SMS and WhatsApp follow-ups a call can trigger.
- 03
Consent logging
In-language disclosure and consent captured as a call-flow node, timestamped and attached to the call record.
- 04
Calling-window enforcement
Time-of-day windows and frequency caps enforced by the platform, not by campaign discipline.
- 05
AI-call disclosure
Callers are told they are speaking to an AI agent. Disclosure is on by default and cannot be silently disabled.
- 06
Per-campaign audit trails
Who dialled whom, when, under which consent, with which script version — exportable for a regulator or an auditor.
TRAI TCCCPR & DLT
Governs how commercial communication reaches a subscriber: registered senders, approved templates, preference registries and calling windows. VARTA scrubs lists, enforces windows and version-controls every script used on a campaign.
DPDP Act 2023
Governs the personal data inside the conversation: notice, consent, purpose limitation, retention and grievance redressal. Consent is a first-class node in the call flow and retention is a department-level setting.
RBI Digital Lending & recovery conduct
Collections agents run with hard-coded conduct rules: permitted hours only, mandatory identification, no coercive language, escalation on distress signals, and a complete audit trail per borrower contact. Guardrails are set at the company level so no department can override them.
Data protection
Where your data lives, and how little of it we keep
India-region by default
Multi-AZ deployment in Indian availability zones, with residency options for other geographies on enterprise plans.
In-memory processing
Conversation audio is processed in memory. Only what your retention policy permits is ever written to durable storage.
Policy-driven retention
Separate windows for audio, transcript and metadata, enforced automatically with deletion receipts.
Certifications
Our current posture, stated honestly
We publish status rather than logos. Where something is in progress, we say so.
ISO 27001
CertifiedInformation security management system certified and surveilled annually.
SOC 2 Type II
In progressControls implemented; observation window underway with an independent auditor.
DPDP Act 2023
ReadyConsent, purpose limitation, retention and grievance controls available and configurable.
GDPR / HIPAA
ReadyControl set mapped; DPA and BAA available for qualifying deployments.
Responsible AI
Rules we hold ourselves to on every call
AI disclosure
Every agent identifies itself as AI at the start of the conversation.
Human escalation on demand
A caller asking for a human always gets one — no loops, no deflection.
Recording transparency
Recording notice is delivered in the caller's language and logged with the call.
Grievance contact
A named grievance officer, published contact, and a 72-hour acknowledgement commitment.
Procurement FAQ
The questions your security review will ask
Where is our data stored?
India-region availability zones by default, with multi-AZ redundancy. Alternative residency is available on enterprise plans.
How long do you retain call data?
Retention is set per department by you and enforced by the platform. Audio, transcript and metadata can carry different windows.
Do you train models on our conversations?
No. Customer conversation data is never used to train foundation models. Improvements you opt into are scoped to your own workspace.
Can we get a DPA and a subprocessor list?
Yes — both are published, and countersigned copies are available on request from your account team.
Will you complete our security questionnaire?
Yes. Send it to the security desk and we typically return it within five working days, along with our latest VAPT summary.
How is conversation audio protected in transit?
TLS 1.3 for signalling and APIs, SRTP for media, AES-256 at rest. Keys are managed in a hardware-backed key store.
Bring us your security questionnaire
We answer procurement reviews in days, not quarters — with the VAPT summary, DPA and subprocessor list attached.