Skip to content

Platform · Compliance

Certified where it
counts, evidenced
where you ask.

Banks, insurers, hospitals and carriers audit us against their own regulations. This page lists the frameworks we hold to, what your deployment inherits, and the control that answers each regulation.

Book a Demo Request the security package
  1. Where your data goesWhat we hold to, and what your estate holds
  2. Risks and controlsA control for each regulation you answer to
  3. EvidenceTwelve frameworks, with their marks
  4. DocumentsThe evidence package, under NDA, on request
Your perimeter, with the Voicing runtime inside itYour perimeter drawn as a system diagram. Telephony enters through a dock on the left edge and people work through a dock on the right; both join the Voicing runtime, where Voice AI Agents, Real-Time Translation, Knowledge Mesh and Agent Assist run. Under the runtime, the models run on your compute and the observability store keeps transcripts, traces and evaluations. Your systems of record dock on the bottom edge and the runtime reads and writes them by policy. Nothing leaves the perimeter.Your perimeterEgress: noneVoicing runtimeVoice AI AgentsAnswers and completes callsReal-Time TranslationBoth directions, mid-callKnowledge MeshCited answers, your recordsAgent AssistThe same answer, for peopleModelsProprietary LLMsSpeech to textText to speechCPU inferenceObservability storeTranscriptsTraces and tool callsEvaluationsRetention you setTelephonySIP and CCaaSSystems of recordCRM, core, ticketsPeopleHuman agentsRead/writeCard numbers are maskedNever written to a transcriptRead by the taskOnly what the call needsInference runs insideNo prompt leaves itRetention is yoursSet by your policyConsent checked at dialInside your call windows
Your perimeter, with the Voicing runtime inside itYour perimeter drawn as a system diagram. Telephony enters through a dock on the left edge and people work through a dock on the right; both join the Voicing runtime, where Voice AI Agents, Real-Time Translation, Knowledge Mesh and Agent Assist run. Under the runtime, the models run on your compute and the observability store keeps transcripts, traces and evaluations. Your systems of record dock on the bottom edge and the runtime reads and writes them by policy. Nothing leaves the perimeter.Your perimeterEgress: noneVoicing runtimeVoice AI AgentsAnswers and completes callsReal-Time TranslationBoth directions, mid-callKnowledge MeshCited answers, your recordsAgent AssistThe same answer, for peopleModelsProprietary LLMsSpeech to textText to speechCPU inferenceObservability storeTranscriptsTraces and tool callsEvaluationsRetention you setTelephonySIP and CCaaSSystems of recordCRM, core, ticketsPeopleHuman agentsRead/write
  1. Card numbers are maskedNever written to a transcript
  2. Read by the taskOnly what the call needs
  3. Inference runs insideNo prompt leaves it
  4. Retention is yoursSet by your policy
  5. Consent checked at dialInside your call windows
  • Certified
  • Inherited
  • Evidenced
Where your data goes01 / 05

What we hold to, what you inherit, what we can show.

A compliance officer needs to know which controls are ours to prove and which are already yours. The runtime runs inside the boundary you already audit, so most of the estate keeps the certificates it holds.

  • What we hold to

    Twelve frameworks, from SOC 2 Type 2 to ISO 42001, with scope.

  • What you inherit

    The runtime runs inside the controls your team already audits.

  • What we can show

    The report behind each one, under NDA, when your review asks.

The inheritance

Most of your estate keeps the certificates it already holds.

One place is yours: the boundary you already audit, on the sage ground the drawing calls inherited. Four parts of your estate stand on it. Your network, drawn as three segments on one bus. Your identity, drawn as a key. Your logging, drawn as a ledger of stamped rows. Your retention policy, drawn as a clock, the window a record is kept for and the stop where it ends. At the boundary's wall stands the runtime, the one new part: the build's layers with the calls running on them, carrying a seal. Outside the wall, a place named Voicing AI holds the build, drawn as stacked layers, and twelve frameworks, drawn as sealed sheets beside their seal. One route from Voicing AI ships into your boundary and lands on the runtime, which arrives with the same seal already on it.
Risks and controls02 / 05

Each regulation, one control we can show.

Pick the regulation your auditor asks about. The panel shows the control that answers it and whether the evidence is signed today or supplied on request.

  1. PCI DSS, taking a card payment
  2. HIPAA, a patient on the line
  3. GDPR and CCPA, a data request
  4. TCPA, outbound calling

RiskPCI DSS, taking a card payment

Card numbers pass through a masked flow and are never written to a transcript.

How it is enforced

The card step runs in a masked flow, so the digits never reach the model, and the transcript records the outcome only.

EvidencePCI DSS

Evidence03 / 05

The frameworks we hold to, and their marks.

Every framework a regulated buyer asks about, with the mark we set beside it. The report behind each one comes with the package.

  • SOC 2 Type 1 and Type 2SOC 2 Type 1 and 2

    How controls are built and run

  • ISO 27001:2022

    Information security

  • ISO 42001:2023

    Management system for AI

  • HIPAA

    Protected health information

  • GDPR

    EU personal data

  • EU AI Act

    AI risk and transparency

  • CSA STAR Level One

    Cloud security self-assessment

  • FedRAMP

    US federal cloud security

  • PCI DSS

    Cardholder data

  • CCPA

    California personal data

  • DORA

    Operational resilience

  • ISO 17442:2020

    Legal entity identifier

Who issued each certification, its reference and when it expires come with the package.

Request the security package
Documents04 / 05

Read the reports before you sign.

Ask for the package and we send the evidence behind each framework, the data-processing terms and a scoped answer to your questionnaire, under NDA where a report requires it.

Retention and consent settings come as they would be set for your estate, and an architect walks your auditor through where each control runs.

Book a DemoRequest the security package

How a review runs

From the first request to your auditor's sign-off.

An exchange between your review team and Voicing AI, in order. You ask for the package. An NDA covers the reports that need one. The evidence arrives, each report with its scope. Your questionnaire comes back answered. An architect walks your auditor through each control.
Closing05 / 05

Bring one call type. Leave with an architecture.

A scheduling desk in a clinic: a nurse in a headset at a screen by the window, a blank planning board on the wall.
Compliance

Built for the most regulated floor

A working session with an engineer who has deployed inside a bank’s perimeter. We map your telephony, data boundary and handoff rules, and tell you what we would not automate.

Book a Demo