Security & data protection

Voice Logica is certified to ISO/IEC 27001 (information security) and ISO/IEC 27701 (privacy), and runs on EU infrastructure. This page explains, in plain terms, what we do with your callers’ data and which protections you can switch on. The full list of measures, retention periods and sub-processors is on our compliance page.

Your callers’ identifiers stay away from the AI

With sensitive-data protection on an agent (Agent → Recording & Privacy):

• ΑΜΚΑ, ΑΦΜ, IBAN, ID, passport and card numbers that callers dictate are replaced by a placeholder such as {{afm_1}} before any AI model sees the text.
• The agent says only the last four digits. The tools it calls (your CRM, a booking) still get the real value.
• The value is stored encrypted, one by one. CVV and PIN codes are never stored.
• In the recording, the moment the caller said the number is replaced by a soft tone.

Details: Sensitive data protection.

You decide who sees what

• Only members with the Reveal sensitive data permission, and company admins, can show a protected value or hear the caller say it. Voice Logica staff don’t get it through their staff role.
• Every reveal, playback and transfer to your own systems is recorded.
• Account → Privacy shows it all on one page: which agents protect data, where real values are sent, and the access log, exportable to CSV.

Real values go only where you allow, never to an AI

If your CRM or ERP needs the real number after the call, you can turn this on for a specific workflow or for the post-call webhook. Only non-AI steps (API calls, integrations, bookings, email) receive it; AI steps keep the placeholder. Each use is recorded.

Encryption

• In transit: TLS 1.3 with post-quantum key exchange on the app, the API and the website. Traffic between our own servers (the database and its connections) is encrypted too, and unencrypted connections are refused.
• At rest: recordings, transcriptions and files are encrypted; credentials, integration tokens and protected caller values are additionally encrypted by the application (AES-256-GCM) with keys that we can rotate.
• Backups: encrypted before they leave our servers, and write-once for their first days, so nobody can alter or delete them.

Sign-in and your own code

• Sign-in is rate-limited, accounts lock temporarily after repeated failures, and two-factor codes allow only a few attempts.
• Code you add to a workflow runs in an isolated sandbox: no network, files or server access, and it never sees anyone else’s data.

A record that can’t be quietly changed

Changes and accesses go into an audit log where every entry is linked to the previous one. Each night, the log’s state is signed by two independent public time-stamping authorities. Any later edit or deletion would show. You can check your own company’s log any time with Verify now on the Privacy page.

Requests from your callers

• By phone: with the Data erasure requests tool on an agent, a caller can ask the agent to delete their data. A request for their own number reaches your Privacy page. You approve it (the data is erased) or reject it with a reason.
• From your team: export or erase everything about one person from Contacts.

Retention

You choose how long each agent keeps recordings and transcriptions (0–180 days), and optionally a shorter limit for protected values. Logs expire automatically. Defaults are listed on the compliance page.

Reporting a security issue

Write to security@voicelogica.ai. Our DPA and legal documents describe how we notify customers of incidents.

Frequently asked questions

Where is my Voice Logica call data stored, and is it encrypted?

Voice Logica runs on EU infrastructure and is certified to ISO/IEC 27001 and ISO/IEC 27701. Recordings, transcriptions and files are encrypted at rest, and credentials, integration tokens and protected caller values are additionally encrypted by the application with AES-256-GCM. Traffic to the app, the API and the website uses TLS 1.3, and backups are encrypted before they leave our servers. The full list of measures and sub-processors is on the compliance page.

Does the Voice Logica AI see my callers' ΑΜΚΑ, ΑΦΜ, IBAN or card numbers?

Not when sensitive-data protection is on for the agent (Agent → Recording & Privacy). These numbers are replaced by a placeholder such as {{afm_1}} before any AI model sees the text, the agent says only the last four digits, and the tools it calls still get the real value. CVV and PIN codes are never stored. See Sensitive data protection.

Who can see my callers' protected data in Voice Logica? Can Voice Logica staff see it?

Only members with the Reveal sensitive data permission, and company admins, can show a protected value or hear the caller say it. Voice Logica staff do not get it through their staff role. Every reveal, playback and transfer to your own systems is recorded, and Account → Privacy shows it all on one page, exportable to CSV.

Deleting calls is its own Delete calls permission, not something that comes with being able to see them. Company admins always have it; a member with it can only delete the calls they can see, and calls on legal hold are never deleted.

How long does Voice Logica keep my call recordings and transcripts?

You choose how long each agent keeps recordings and transcriptions, from 0 to 180 days, and optionally a shorter limit for protected values. Logs expire automatically. The defaults are listed on the compliance page.

Can a caller ask Voice Logica to delete their data?

Yes. With the Data erasure requests tool on an agent, a caller can ask the agent by phone to delete their data, and the request for their own number reaches your Privacy page. You approve it, which erases the data, or reject it with a reason. Your team can also export or erase everything about one person from Contacts.

How do I report a security issue to Voice Logica?

Write to security@voicelogica.ai. Our DPA and legal documents describe how we notify customers of incidents.