These are capabilities that help an organisation meet its own obligations. They do not make an organisation compliant by themselves: policies, training and contracts remain the customer's to put in place.
HIPAA Built to support
Settings that support HIPAA obligations when assistants handle patient calls.
- Staff roles with read-only access for auditors; reviewers must choose to unmask patient information, and every view, export and hold is recorded with the reviewer's name.
- Recording retention periods and legal holds that stop deletion of calls under review.
- Tamper-evident audit: finished calls are sealed so a change can be detected.
- Caller identity checks before details are shared, and wording for new patients.
PCI-DSS Built to support
Taking card details by phone without the assistant, the transcript or the recording keeping them.
- The caller types the card number on the keypad and the digits go straight to the payment provider (Stripe, Adyen or your own); the assistant learns only whether the payment worked.
- A card number spoken aloud is masked in the transcript.
- A scan raises an alarm if a card-number pattern is found in stored call data.
- Payment capture is part of the Regulated plan.
GDPR / UK GDPR Built to support
Consent, access, portability and erasure for personal data in calls.
- A recording notice with the caller's agreement where your rules require it, and a choice of what happens when someone declines.
- A signed, expiring export of an account's own data.
- Erasure by phone number, email or keyword with a dry run first, logged with a hash of the subject rather than the subject.
- Records under audit or legal hold are protected for their retention period.
TCPA and outbound calling rules Built to support
Settings that keep outbound campaigns inside calling-hour, consent and opt-out rules.
- Calling hours in each campaign's time zone, and a daily limit.
- Do-not-call list checks before a number is dialled.
- A keypad digit that removes the person, and a cap on dropped calls.
- Rules differ by country and type of call: confirm the specifics with your counsel.
ADA and Section 508 accessibility Built to support
Letting deaf, hard-of-hearing and speech-impaired callers use the same service.
- Text telephone (TTY) callers are recognised by their tones and answered in text, with hand-over to a person trained on TTY.
- Speech pace that adapts to the caller, and live captions on a second device.
- An offer of text messages or chat instead of a voice call.
- Test with a real TTY device or an emulator before go-live.
STIR/SHAKEN caller ID attestation Built to support
Outbound campaigns can require a signed caller ID.
- Each campaign records its caller ID attestation level, and can be blocked from starting unless it is level A.
- The platform records what you declare; it cannot sign a call itself. Your carrier signs the number.