Enterprise-grade voice AI built on trust, security, and sovereignty.
Review Vatel AI's active security posture, SOC 2 alignment, Quebec Law 25 compliance, and data protection controls.
At Vatel AI, privacy and security are built into how we design and operate our voice platform. Call audio, transcripts, and database records are encrypted in transit (TLS) and at rest (AES-256). Our platform runs on SOC 2 Type II certified infrastructure providers (Google Cloud and Supabase), and customers can configure retention rules from 24 hours to 2 years, or disable call recordings entirely. Vatel's own SOC 2 Type II and ISO 27001 programs are currently in progress.
Compliance frameworks
Quebec's Law 25
Our practices are designed around Law 25: consent workflows, customer data isolation, configurable retention and deletion, and a designated person in charge of the protection of personal information.
SOC 2 Type II
In progress. Our infrastructure is hosted on SOC 2 Type II certified providers (Google Cloud and Supabase).
PIPEDA (Canada)
Canadian federal privacy standard.
ISO 27001:2022
In progress, aligned with ISO/IEC 27001:2022.
HIPAA
Safeguards for protected health information when healthcare customers use Vatel.
GDPR
Access and erasure rights supported. DPA available at vatel.ai/legal/dpa.
Core security controls
TLS
Encryption across all SIP trunks, WebSockets & REST APIs.
AES-256
Databases, audio files, and transcripts encrypted at rest.
RBAC
MFA, SSO, need-to-know staff privileges.
Isolated enterprise cloud nodes
Google Cloud & Supabase · Canada / US
Automated retention & destruction · Law 25 / HIPAAIn transit
All telephony SIP traffic, WebRTC audio streams, REST API queries, and WebSockets are encrypted using TLS.
At rest
Database tables, conversation logs, customer records, and call audio files are encrypted using AES-256 bit encryption.
No training on your data
Vatel does not use identifiable customer data to train AI models, and our default language model provider does not train on your data.
Zero data retention (on request)
For customers with stricter requirements, such as healthcare, legal, and financial services, Vatel offers a Zero Data Retention configuration. When enabled, call audio, transcripts, and generated speech are not retained by our speech and voice providers after processing. Contact security@vatel.ai to enable it.
Custom retention schedules
Enterprise administrators can configure custom data retention rules per agent—from 24 hours up to 2 years—after which call recordings, audio snippets, and transcripts are permanently purged from server memory.
Sensitive call handling
Audio recordings can be completely disabled for specific sensitive agents or call types (e.g., medical triage, payment confirmation) while retaining only structured metadata.
Role-based access control (RBAC)
Granular permission controls restricting access to agent configuration, transcripts, and analytics based on employee roles.
Mandatory multi-factor authentication (MFA)
Enforced across all internal administrative access and customer console accounts.
Secrets management
API keys, database credentials, and SIP tokens are managed in isolated, encrypted vaults with automated rotation.
Environment segregation
Strict separation between Development, Staging, and Production environments. Production data is never used in non-production testing.
DDoS & cloud firewalls
Protected by enterprise Web Application Firewalls (WAF) and Cloudflare rate-limiting.
Same-day rollback
Automated CI/CD pipeline allowing instant version rollback in the event of software anomalies.
Documents
SOC 2 report
Infrastructure audit
Data Processing Addendum
Includes SCCs
RequestSecurity questionnaire
Vendor assessment
Subprocessors directory
Vendors that may process customer data to operate Vatel. Locations are the primary processing regions for each provider.
| Company | Purpose | Location |
|---|---|---|
| Infrastructure | ||
| Google Cloud | Servers. | United States, Canada |
| Vercel | Hosting. LLM. | United States, Canada |
| Supabase | Authentication, database, storage. | United States |
| GitHub | Source control, CI/CD. | United States |
| Better Stack | Logging. | United States |
| Stripe | Billing. | United States |
| Resend | Email. | United States |
| Voice & audio | ||
| ElevenLabs | Voices. | United States, EU |
| Deepgram | Transcriber. | United States, EU |
| OpenAI | LLM, Voice. | United States, EU |
| AssemblyAI | Transcriber. | United States, EU |
| LLM, Transcriber, Voices. | United States, EU | |
| Gladia | Transcriber. | United States, EU |
| Soniox | Transcriber. | United States, EU |
| Speechmatics | Transcriber. | United States, EU |
| xAI | LLM, Voice. | United States, EU |
| Cartesia | Voices. | United States, EU |
| Hume AI | Voice. | United States |
| MiniMax | Voice, LLM. | China |
| Fish Audio | Voices. | China |
| Inworld AI | Voice. | United States |
| LLMs & gateways | ||
| LLM. | United States, EU | |
| OpenRouter | LLM. | United States |
| Anthropic | LLM. | United States, EU |
| Alibaba / Qwen | LLM. | China |
| Moonshot AI | LLM. | China |
| Zhipu / Z.AI | LLM. | China |
| IBM | LLM. | United States |
| DeepSeek | LLM. | China |
| Communications | ||
| Twilio | Telephony. | United States, EU |
| Customer integrations | ||
| Customer HTTP webhooks | Customer-configured endpoints. | Customer-determined |
SIP peers
SIP trunks and SBCs peered to Vatel are not Vatel-owned subprocessors unless separately contracted.
FAQ
Answers on Law 25, HIPAA, model training, and how to request SOC 2 reports or a DPA.
Vatel is designed around Law 25's privacy-by-design principles. Customer data, voice streams, and transcripts are encrypted in transit and at rest, retention can be set per agent, and call recordings can be disabled. Our person in charge of the protection of personal information can be reached at privacy@vatel.ai.
Yes. For healthcare providers, dental networks, and medical clinics, Vatel implements appropriate safeguards for protected health information. Contact security@vatel.ai to discuss your requirements.
No. Vatel does not use identifiable customer data to train AI models. We may use irreversibly anonymized, aggregated data to improve the service, and you can opt out at any time by contacting privacy@vatel.ai.
To request formal compliance documentation, execute a Data Processing Addendum (DPA), or submit a vendor security assessment, please contact our security team at security@vatel.ai.
Request a security review
Headquarters: Devpro Digital / Vatel AI, Montreal, QC, Canada