Snapshot 225112
Normalized text
Scripts and page chrome removed; this is what change detection compares.
Trust Center How Modulate secures the audio you send us, who can access it, and what happens to it after analysis. Public documents are below. Sensitive reports are available on request. Privacy Policy security@modulate.ai Last reviewed October 2026 Overview Delivering trusted audio-native voice AI models and full conversation understanding with the Velma API throughout enterprise and regulated industries. With over 600M hours of audio analyzed and 40M unique business risks detected, Modulate helps you build fraud prevention, AI agent guardrails, and IT security into your audio pipeline, and add best-in-class transcription with confidence. Compliance Certifications, audits, and standard agreements to ensure compliance. Certified ISO 27001 Certified for ToxMod. The same security controls and governance practices apply to the Velma platform. In progress SOC 2 Type II Audit underway for the Modulate API Platform. Report expected by January 2027. DPA available GDPR, UK GDPR & CCPA We act as your data processor. Our DPA includes EU Standard Contractual Clauses and the UK Addendum. BAA available HIPAA We sign a Business Associate Agreement before any protected health information is processed. SOC 2 Type II progress Step 1 Controls in place Complete Step 2 Independent audit Underway, Q4 2026 Step 3 Report available on request Expected by January 2027 GDPR Compliance Overview Modulate acts as the customer's Data Processor. Modulate provides API endpoints that process customer data at the customer's request and returns the results of that processing back to the customer. Customers determine the purpose of processing and are responsible for the lawful collection and use of their end users' data. The following is an overview of how Modulate handles customer data and allows customers to be compliant while using Modulate's services under standard service agreements. Specific agreements may modify the information provided in this overview. Read the full overview Documents View public documents right away. For anything else listed, contact us to send a request and we'll have a team member from our security team reach out to assist. All Public On request Document Category Access SOC 2 Type II report Available once the audit is complete, expected by January 2027. Compliance In progress Privacy Policy and Velma Services Privacy Addendum How we collect, use, and protect personal data, including practices specific to Velma. Legal Public View Velma Platform Terms of Service Terms for the Velma API and Modulate Platform. Legal Public View ToxMod Terms of Service Terms for ToxMod voice moderation. Legal Public View Subprocessor list Third parties that process customer data on our behalf. Legal Public View Virtual Patent Marking Notice Patents covering Modulate products. Legal Public View Data Management and Storage How Modulate manages, stores, and retains customer data. Security Public View Data Processing Agreement Our standard DPA, including EU Standard Contractual Clauses and the UK Addendum. Legal On request Business Associate Agreement Our standard BAA for customers processing protected health information. Legal On request Security and Compliance overview Answers to common security review questions for the Modulate API Platform. Security On request Penetration test summary Independent web application test of the Modulate API Platform, August 2026. Security On request ISO 27001 certificate Certificate of registration covering ToxMod Compliance On request kidSAFE COPPA certificate COPPA+ and SAFE seals certified for ToxMod Compliance Public View Security practices The controls behind the Modulate API, Velma Platform, and ToxMod. Infrastructure Services run in isolated virtual private clouds with security groups and network access controls Intrusion detection and continuous monitoring with AWS GuardDuty Redundant databases, regular backups, and failover Data protection AES-256 encryption for stored data TLS encryption for all API and console traffic Most API endpoints never store your audio Application security Independent penetration test every year, most recently August 2026 Static code analysis and security review of source code API keys tied to unique accounts People and access Least-privilege, role-based access, reviewed every six months Every request for access to customer data is logged and approved Background checks for all employees before hire How we handle your audio Voice data is sensitive. Here's where it goes and how long it stays. Where it's processed In the United States by default. Other regions can be arranged by agreement. EU and UK transfers are covered by Standard Contractual Clauses. How long we keep it Most developer API endpoints don't store audio at all. Features that do store audio keep it for 35 days, then delete it. Enterprise customers can set custom retention. Model training Enterprise customers can opt out of model training, and we can write zero training into your contract. Self-serve accounts are part of our Model Improvement Program. Audio uploaded to Velma Preview is never used for training. Deleting your data Delete audio and outputs any time through the dashboard or API. When a contract ends, we return or delete customer data and confirm deletion on request. Contact Reach the right team directly. Security questions and vulnerability reports security@modulate.ai Privacy and data requests privacy@modulate.ai DPAs, BAAs, and legal legal@modulate.ai