Snapshot 240831
Normalized text
Scripts and page chrome removed; this is what change detection compares.
The evidence wall Certified, in audit, or enforced. Never blurred. Three statuses, and we use the words exactly. Certified means a certificate you can check. In audit means the work is under way and we do not call it done. Enforced means the control is in the software and cannot be skipped by a person having a bad day. 01Certified ISO 27001:2022 Information-security management. Certificate IC-IS-2505161, issued by INTERCERT, valid to 2028. 02Audit in progress SOC 2 Type II Service-organisation controls. Not certified yet, and we will not describe it as such until the report is in hand. 03Audit in progress ISO 42001 AI management system. The standard for how an AI programme is governed, not just secured. 04Controls in place DPDP Act 2023 Notice at the start of the call, purpose-limited fields, data-principal requests routed through your DPA. 05Enforced in the dialler RBI and TRAI contact rules Contact hours, frequency caps, DND and consent gate the dialler. A non-compliant call cannot be placed. 06Links, not card numbers Payments The AI sends a payment link. Card numbers are not spoken into the call, and do not sit in a transcript. Where the data goes Your record stays yours. We hold the call, in India, encrypted. We read only the fields the conversation needs. The recording, transcript and score live in our India-region estate under managed-key encryption. The result is written back to your systems, and the handover summary reaches your agent desk by webhook or on Vox Agent Desktop. Nothing leaves the region. What a person on our side can see The console masks what it does not need to show. The AI tells the customer the call is recorded. Phone numbers and account identifiers show as fragments on the agent's screen. If a customer starts to read a card number out, the AI stops them and sends a payment link instead, so the number is never in the audio or the transcript. Access to recordings is role-based, behind MFA, and every access is logged. Recording notice at the start of every call Phone and account identifiers masked on screen Card numbers redirected to a payment link Role-based access to recordings, MFA, access log Vox Agent Desktop · simulationPII masking · on AINamaste. This call is recorded. Am I speaking with the account holder ending •• 7 1 2? CustomerYes. My number is +91 98••• ••412, I changed it last month. AIUpdated. Your EMI of Rs 4,120 is due on the 26th. Would you like the payment link on WhatsApp? CustomerCan I pay by card now? It is 4 4 1 7 •••• AIPlease do not read the card out. I have sent a secure link; the card is entered there, not here. HandoverPriya (agent) joined · summary received · PAN fields masked on this screen values on this screen are simulated · masking and logging behaviour is as shipped Retention How long we keep what, and who decides. Retention is set in your data-processing agreement, not by us alone. Where a regulator sets a floor, we configure to it: the Reserve Bank's recovery-call directions of 6 August 2026, in force from 1 January 2027, require every recovery call to be recorded, the borrower told it is recorded, and the recording kept for at least six months, longer while a dispute is open. What Where it lives Protection How long Call recording and transcript Oriserve, India region encrypted at rest · access logged Set in your DPA. Collections programmes default to the RBI floor of six months from the call. Post-call score and QA findings Oriserve, India region tied to the call record Same period as the recording it scores. Fields read from your systems In the call, then your systems scoped to the conversation Held for the call. The record of truth stays in your CRM. Disposition and summary Your CRM and agent desk written back by webhook Your retention policy applies; it is your record. Model tuning on your programme Oriserve, your tenancy not shared across clients For the life of the programme, then per your DPA. Access logs Oriserve who opened what, when Kept for audit; available to your risk team on request. Regulatory reference: RBI directions issued 6 Aug 2026 (nine circulars), in force 1 Jan 2027: recovery calls between 8 am and 7 pm, every call recorded and retained at least six months. Public sources, checked 8 Nov 2026. Your own counsel decides what applies to your book. DPDP Act 2023 What we do as your processor, in plain words. Notice The customer is told Every call opens with a recording notice in the customer's language. The purpose of the call is stated before any data is used. Purpose limitation Only the fields the call needs The field scope is written into the DPA. We do not take a table dump because we do not need one, and a smaller scope is easier for both sides to defend. Data-principal requests Routed through you Access, correction and erasure requests reach us through the channel named in your DPA, and we act within the period it sets. You remain the fiduciary; we are the processor. Incidents Told, not discovered Breach notification, the contact on each side and the clock are written into the DPA, and the same incident process is part of the ISO 27001 management system that was certified. A DPA, a security pack with the sub-processor list, and answers to your assessment questionnaire are part of onboarding. Ask for them on the first call. What security teams ask Where is our data stored? In India, resident by default. Customer and call data stays in-region, encrypted at rest and access-controlled, and what the platform learns on your book improves only your book. Are you certified, or just aligned? ISO 27001:2022 certified and in hand: certificate IC-IS-2505161, issued by INTERCERT, valid to 2028. SOC 2 Type II and ISO 42001 audits are in progress and we do not describe either as certified. DPDP, RBI and TRAI contact rules are enforced in how the platform operates. How is card and payment data handled? The AI sends a payment link rather than taking a card number on the call. If a customer begins to read a card out, the AI stops them, so card numbers do not sit in audio or transcripts. Who can access recordings? Only authorised roles, with MFA and full access logging. Recordings are encrypted and access-controlled, and every access is logged for audit. The console masks phone and account identifiers on screen. How long are recordings kept? As set in your data-processing agreement. For collections programmes the default is the RBI floor: recordings kept at least six months from the call, longer while a dispute is open, under the directions in force from 1 January 2027. Does our data train your models for other clients? No. Tuning that improves your calls stays inside your programme. The exact wording is in the data-processing terms, not buried on a web page. Can you meet our procurement and DPA requirements? Yes. A security pack, a data-processing agreement with the sub-processor list, and answers to your assessment are part of onboarding; residency and audit are the default architecture, not add-ons. What happens when a system of record is unreachable mid-call? The AI does not invent an answer. It handles the part it can without the record or routes to a person, and the failure is logged as a failure rather than dressed up as a completed call.