Honest about where we are — and where we're going.
We're not yet SOC 2 audited. This page documents what we have today, what's on the way, and how we handle compliance across every region we sell into.
Today's posture.
Regional compliance.
GDPR — EU & UK
Legitimate-interest basis, DPIA available on request, SCCs for transfers outside EEA, 30-day DPO SLA.
CCPA — California
Do-Not-Sell honoured at ingestion. Export and deletion requests handled within 45 days.
PDPL — UAE & KSA
DPO contact via our form. 72-hour breach notification. Right to access and rectification honoured.
LGPD — Brazil
Same posture as GDPR for cross-border transfers. ANPD correspondence on request.
POPIA — South Africa
Lawful-basis registration. Operator relationship documented per Section 20.
PIPEDA — Canada
Accountability principle followed. Express consent for recordings. OPC correspondence on request.
Where data lives.
Recordings are retained only for the window your tier defines (30 / 90 / 365 days). Full sub-processor list with scopes is available on request for enterprise due diligence.