Security and privacy
How we handle your calls and your data.
Each business's data is kept separate, sensitive actions are logged, recordings aren't public links, and we don't claim certifications we don't hold.
Your data stays yours
Every request is scoped to your business in the API and service layers, and automated tests try to read and write across businesses to prove they can't.
Changes leave a trail
Publishing, billing changes, exports, support access to your account and event replays create audit records that can't be edited.
Recordings aren't public links
Recordings play through signed or proxied access. The voice provider's recording links are never shown directly.
Incoming events are verified
Provider events are checked for signature, timestamp and replays, processed once, and retried or set aside for review if they fail.
Call history expires
Recordings, transcripts and call records are kept for up to your plan's retention period (30, 90, 180 or 365 days, depending on the plan), then deleted automatically, including the copies our voice provider stores. Choosing a shorter period, or moving to a plan with a shorter one, permanently deletes calls older than the new period. You can export call records before then.
Callers are told it's an AI
The AI disclosure is given at the start of every call and can't be switched off. A recording notice is added when you record.
Frontal Voice does not claim HIPAA compliance, SOC 2 or any other regulatory certification. You decide disclosure and consent for your jurisdiction. Patient information requires a separate written agreement, which isn't available yet.