Security
Security & trust
HiloVoice speaks directly with your customers, so how we handle data matters. Here's how it works today.
Your organization's data controls
- Encryption
- In transit and at rest
- Call recordings
- You decide
- Transcript retention
- Configurable
- Agent permissions
- Only what you approve
Scoped to your organization
How HiloVoice handles data
Your data stays yours.
Your organization's agent configurations, contacts, call records, and outcomes are scoped to your organization and never shared across organizations.
Your organization
- Agent configurations
- Contacts
- Call records
- Outcomes
Another organization
Tenant isolation
Every request is scoped to your organization. HiloVoice's services are designed so a request cannot reach another organization's data, even if an identifier is supplied incorrectly.
- In transitTLS
- At restEncrypted
Encryption
Data is encrypted in transit (TLS) and at rest.
- Owner
- Admin
- Builder
- Analyst
Access controls
Roles — Owner, Admin, Builder, Analyst — control what each team member can see and do inside your organization.
ActivityIllustrative
- 09:14BuilderChanged a configuration
- 10:02AdminPublished an agent
- 11:37OwnerLaunched a campaign
Auditability
Key actions — publishing an agent, launching a campaign, changing a configuration — are recorded so you can see who did what, and when.
Practices
How it works today.
Retention, permissions, escalation, providers, and the controls behind responsible outbound calling.
Credentials and secrets
API keys and integration credentials are stored in an encrypted credential store — never in agent definitions, call transcripts, or logs.
Call recordings
Audio retention is configurable. You control whether call recordings are stored, and for how long.
Messages and attachments
Texts, emails, and documents a caller sends to an agent during a call are stored with that call, under the same organization scoping, encryption, and retention settings as its transcript.
Transcript retention
Transcript retention is configurable per organization, so you can align storage with your own data policies.
Agent permissions
Each agent is limited to the specific information and actions you approve — nothing more.
Human escalation
Agents can be configured to transfer or escalate a conversation to a person whenever the workflow calls for it.
Provider subprocessors
HiloVoice's initial voice runtime and telephony are provided by third-party infrastructure. We'll keep this page updated as our subprocessor list changes.
Compliance controls
Outbound calling includes configurable do-not-call handling, opt-out tracking, and calling-window restrictions by jurisdiction.
Responsible outbound calling
We don't assume a technically callable number is a legally callable one. Campaign controls exist to help you respect consent, calling windows, and opt-outs.
Compliance
Our SOC 2, HIPAA, and GDPR compliance work is in progress. We'll publish each here as soon as it's complete.
Questions
Have a security question?
Questionnaires, vulnerability reports, and how we handle data.
See the controls for yourself.
Create an agent, set what it can see and do, and test it before it ever talks to a customer.