Trust and data handling

Implemented today

Present in the platform and verifiable in the codebase.

Public status page

Automated checks run against the published site every 15 minutes and the results are published at /status, including publishing health and seven day uptime.

AI identity disclosure

Cody opens every conversation by identifying itself as an AI assistant, states that the conversation is recorded, and hands off to a person on request. The opener is defined server side, not left to the model.

Recording consent

Recording is disclosed in the opening line before any qualifying question is asked. A caller who declines recording is routed to a human path rather than continuing under an assumed consent.

Inbound calls only

Voice coverage is inbound only. EchoCody answers calls placed to your numbers and conversations a visitor starts on your site. Follow up on consented records runs over SMS, email and forms, and a message never triggers a voice call.

Consent ledger

Consent is recorded as append only events with a status of granted, revoked or superseded, plus scope, channel, purpose, source, effective time and an evidence hash. The ledger stores the evidence hash, not raw audio. Outbound actions fail closed when no verified active consent exists.

Session mode integrity

Each web demo session is labelled live or demo. When the live line cannot be reached, the interface states that it is in demo mode rather than presenting a scripted response as a real call.

Durable call receipts

Every session carries a unique call event id used as an idempotency key. Terminal call records are delivered with bounded retries and backoff, and a start and completion ledger exists to reconcile records that never arrived.

Access control on call data

Call records, latency records, call receipts and consent events are service-role only. Row level security is enabled and the anonymous and authenticated roles hold no privileges on those tables. Browser code never receives API keys, prompts, tokens or transcripts.

Encryption in transit

The public site and every API endpoint are served over HTTPS, with HTTP and www requests permanently redirected to the canonical https://echocody.ai origin. Managed database and storage services encrypt data at rest by their own default configuration.

Security event logging

Security relevant events are logged for anomaly review, and audio and public endpoints are rate limited with concurrency gates. Logs are written redacted.

Deployment dependent

Real controls whose behaviour is set during your connect and launch stages.

Suppression and quiet hours for consented messaging

Where consented follow up messaging is enabled, STOP and equivalent opt outs are honoured immediately and suppress the contact across campaigns, and automated sending is restricted to 08:00 to 21:00 in the contact's local time. When the timezone is unknown, sending holds and an owner task is created. These rules apply to the messaging configuration in your account.

Data written to your systems

Which fields are written, to which pipeline, calendar and owner, is set during the connect stage and proven with a connection test receipt before launch. Nothing is written to a system you have not nominated.

Retention and deletion

Call records, transcripts and consent events held by EchoCody are retained for the period agreed in your order, after which they are deleted. Data written into your CRM, calendar or telephony provider is governed by your own retention settings with those providers. Deletion or export requests are actioned on written request from an authorised contact.

Two party consent jurisdictions

Recording behaviour is configured to the states and provinces you operate in during deployment. You remain responsible for confirming your own recording obligations with counsel.

Data categories

Caller identifiers

Phone number, name given on the call, and the number dialled.

Conversation data

Call audio where recording is disclosed and not declined, transcripts and turn timing.

Job context

Service type, address or service area, urgency and scheduling preference.

Outcome records

Booking result, qualification fields, routing and escalation decisions, and the resulting CRM record references.

Consent records

Consent status, scope, channel, purpose, source, effective time and evidence hash.

Operational telemetry

Latency, error and security events used to run the service. Written redacted.

Website analytics

Aggregate page and conversion events for the public site. No call content is included.

Infrastructure and subprocessors

Only providers confirmed in this codebase are listed. Telephony, CRM and calendar providers used in your deployment are the accounts you supply, under your own agreements with them.

Managed application platform

Hosts the public site and server functions.

Managed Postgres and storage

Stores call, receipt and consent records.

Realtime voice provider

Speech synthesis and conversational voice for the pinned agent.

Model provider

Language model inference for conversation handling and qualification.

Telephony provider

Inbound call transport for deployments that use a phone line.

A named subprocessor list with entity names and processing locations is provided under agreement on request.

Roadmap, not live

Listed so the gap is explicit. None of these are available today.

Customer facing audit export

Self service export of consent and call receipts is planned. Today exports are produced on request.

Third party audits and certifications

EchoCody holds no SOC 2, ISO 27001, HIPAA, PCI or GDPR certification, and none is claimed. If that changes, the evidence will be published here with the report date and auditor.