Security

• In transit: TLS 1.2 or higher for all data moving between the client, the TelEcho API, telephony carriers, and downstream AI providers
• At rest: AES-256 for call recordings, transcripts, chat/WhatsApp message content, workflow configuration, and application databases

• Role-based access control (RBAC) enforced on a least-privilege basis for internal systems that touch Customer Data
• Single sign-on (SSO) and multi-factor authentication (MFA) available for Enterprise-tier Customer accounts, and enforced internally for administrative access to production systems

• Segmented production environments, isolating the telephony routing layer, application layer, and data stores from each other
• Perimeter defense via firewall and web application firewall (WAF)
• Private networking for backend service-to-service communication
• Centralized logging and intrusion detection across the API, telephony, and application layers, with audit trails for any access to Customer Data

• Periodic vulnerability scanning of production infrastructure
• Recurring third-party penetration testing (cadence confirmed to prospective Enterprise Customers under NDA)

• Encrypted, redundant backups across availability zones for the cloud region selected by the Customer
• Documented incident-response and disaster-recovery procedures with defined roles and escalation paths
• Recovery Time Objective (RTO) and Recovery Point Objective (RPO) figures available to Enterprise Customers under NDA

• Confidentiality agreements and security-awareness training required for all personnel with access to Customer Data
• Background checks conducted where legally permitted
• Access to production systems is provisioned least-privilege and reviewed periodically

TelEcho routes voice traffic through PSTN/SIP-trunked telephony carriers (see Sub-processors below) for call origination and termination. Call setup, routing, and disposition are measured against the uptime commitments in Section 1 of our Service Level Agreement. Voice response latency for the Ultra Low Latency tier is measured end-to-end, from end-of-speech detection to first audio byte returned, with a median target under 500 milliseconds.

Inbound audio is processed through a speech-to-text (STT) provider to produce a transcript, the transcript and call context are passed to a large language model (LLM) provider for reasoning and response generation, and the generated response text is passed to a text-to-speech (TTS) provider to produce outbound audio. Each of these providers is a named Sub-processor (see table below). Where the provider offers a data-training opt-out at the API level, we configure that opt-out so Customer-submitted audio, transcripts, and workflow context are not used to train the provider's general-purpose models. TelEcho does not use identifiable Customer content to train its own proprietary models unless explicitly agreed with the Customer.

• Recording consent: Where TelEcho records or transcribes a call, the Customer, not TelEcho, is responsible for providing legally required notice and obtaining any required consent under applicable recording-consent, wiretapping, and data protection laws
• TCPA: Customers deploying outbound or automated calling/messaging are responsible for compliance with the U.S. Telephone Consumer Protection Act and equivalent Do-Not-Call regulations in other jurisdictions
• PHI: Customers may not submit protected health information unless a signed Business Associate Agreement (BAA) is in place and the HIPAA-eligible configuration is enabled
• PCI: Customers may not transmit unmasked payment card numbers through voice or chat transcripts outside of an approved, tokenized workflow

See our Terms of Service Section 2.2 and Privacy Policy Section 10 for the contractual language behind these obligations.

TelEcho engages the following Sub-processors to provide the Service. RTC LEAGUE provides at least fourteen (14) days' notice of any new Sub-processor via this page or by email before that Sub-processor processes Customer Data.

• Voice response latency: median end-to-end latency under 500ms for the Ultra Low Latency tier, from end-of-speech detection to first audio byte returned
• Concurrency: guaranteed concurrent call capacity per your Order Form (e.g., 50+ concurrent calls), with additional capacity available on request

Build and Pay-as-you-go tiers receive commercially reasonable efforts but are not covered by SLA service credits unless otherwise agreed in writing.

Available under NDA to Enterprise Customers, contact your account representative or email info@telecho.io:

• Master Services Agreement (MSA)
• Data Processing Agreement (DPA)
• Service Level Agreement (SLA)
• SOC 2 Type II report
• Business Associate Agreement (BAA), for customers processing PHI
• Completed Vendor Risk Questionnaire (SIG Lite / CAIQ)