We don't keep your call recordings.
Word Is Bond tests voice agents. By default, call audio is processed in transit and is not retained in our storage. If you enable optional recording, audio is written to storage you control; we keep a pointer to that recording.
See the Privacy notice for data handling terms.
What happens to your call data
The product's value is the history of your scores — regression and drift over time — so transcripts and scorecards are stored. Optional recordings remain in customer-owned storage under that customer's retention policy.
Audio stays out of our storage
By default, media frames are decoded, streamed to speech-to-text, and dropped. Optional bring-your-own-storage recording writes audio to your storage; wordis-bond stores the recording pointer.
Transcripts age out
Call-log transcript columns are scheduled for erasure 365 days after a run. Scorecards and metrics remain for the life of the account; short-lived transcription cache entries expire sooner.
Diagnostic data
Request logs and error reports are designed to omit call audio and transcript content. We review diagnostic fields as part of our data inventory.
How the platform is secured
Plain, verifiable controls — the same ones a security team asks about in a questionnaire.
| Control | How it works |
|---|---|
| Encryption in transit | HTTPS and WSS protect application connections; phone-carrier transport follows the selected call path. |
| Encryption at rest | Transcript columns use application-level encryption. Cloudflare provides object storage and cache; the application database is self-hosted PostgreSQL. Infrastructure certifications do not certify this application. |
| Account access | Account tools require sign-in. We are validating data separation across the API before broad self-service availability. |
| Access to production | Application secrets are managed outside source code. Production changes pass automated checks before deployment. |
| Change management | Application changes use pull requests, continuous-integration checks, and static analysis (CodeQL). |
| Monitoring | Application errors are monitored; diagnostic data is reviewed to reduce sensitive content. |
| Your data, on demand | Current API export covers part of the account record. Contact us about export or erasure while we complete billing and storage reconciliation. |
Processing and infrastructure providers
These application integrations may process the data listed below. We are completing a field-level inventory; ask for the current subprocessor details before onboarding.
| Provider | Role | What it sees |
|---|---|---|
| Cloudflare | Runtime, object storage, cache, database pooling | Data in transit; your own synthesized script clips and a 24-hour transcription cache at rest |
| Self-hosted PostgreSQL | Database | Transcripts, scores, accounts, contacts, usage |
| Deepgram | Speech-to-text | Call audio (converted to text) |
| Telnyx | Carrier transport (paid tiers, phone-line path only) | Phone numbers and call audio on the carrier path; skipped entirely on the direct path |
| ElevenLabs | Text-to-speech | Your script text (never caller audio) |
| Anthropic · xAI · Groq | Scoring and language | Transcript text |
| Stripe | Billing | Billing details; card data is entered directly with Stripe and never reaches us |
| Resend | Transactional email | Recipient email address and message body |
| PostHog | Product analytics | Product event metadata |
| Sentry | Error monitoring | Diagnostic error context after application redaction |
Provider certifications describe those services and do not constitute a wordis-bond certification. Direct and SIP paths avoid the phone-carrier path when configured without it.
Compliance posture
Word Is Bond is not currently SOC 2 certified. We can provide current control details and discuss a security review before you connect an agent.
Keeping your own recordings Pro and Enterprise
By default, we don't retain call recordings. Where enabled and verified for your plan, optional recording can write audio to storage you own and control. Your storage provider sets its charges and retention policy; ask us to verify compatibility before relying on this path.
Need our DPA or a security review?
Ask about data handling and subprocessors, or send your security questionnaire.
Contact security@wordis-bond.com