> ## Documentation Index
> Fetch the complete documentation index at: https://docs.revdesk.com/llms.txt
> Use this file to discover all available pages before exploring further.
# Security
> Encryption posture, sub-processors, access controls, retention, and residency. The full picture for security and compliance reviews.
# Security at RevDesk
RevDesk runs revenue conversations for regulated and high-trust businesses. The platform is built on encryption-everywhere defaults, named sub-processors with executed agreements, scoped access controls, and a documented audit trail. This page is the public reference. The detailed packet is available under NDA via sales.
SOC 2 mapping, sub-processor BAAs, security assessment summary, DPA, incident response runbook.
## Encryption
| Layer | Posture |
| ------------------- | ------------------------------------------------------------------------------------------------------------------------------------------- |
| In transit | TLS 1.2 or higher everywhere, TLS 1.3 on every public web surface. SRTP on real-time media. |
| At rest | AES-256 for every data store: Postgres, Vercel Blob (recordings, LOAs), backups. |
| Application secrets | Encrypted with `REVDESK_ENCRYPTION_KEY` before persistence. Provider keys never appear in plaintext logs. |
| Recordings | Encrypted at rest. Signed URLs expire on access. Retention default 90 days, tightened to 30 days under HIPAA mode; configurable per number. |
## Access controls
* **SSO and SAML** on Enterprise. Users are provisioned into the organization on first successful SSO login. RevDesk does not offer SCIM or IdP directory sync, so deprovisioning is performed in RevDesk or by revoking access at the IdP.
* **Row-level scoping.** Every API query runs through an ownership filter scoped to the authenticated principal's org and team visibility. Cross-tenant reads are not architecturally reachable.
* **Audit log on every mutation.** Recorded via tRPC middleware. Exportable on request.
* **Outreach disclosure attestation.** Every outbound call and SMS persists whether a recording disclosure or STOP-instructions phrase was attached at send time, plus a two-party-consent state flag for calls. Exportable via the Compliance Center on the Outreach page. See [Outreach audit](/concepts/outreach-audit).
* **Sub-entity isolation** for multi-tenant operators. See [Sub-entities](/concepts/sub-entities).
## Sub-processors
The authoritative, versioned list — every sub-processor, what each receives, and where it processes — is published at [revdesk.com/subprocessors](https://www.revdesk.com/subprocessors) and is incorporated into Annex III of your DPA. We give 30 days' notice before a new sub-processor begins processing, with a right to object. Highlights:
| Service | Role | BAA / DPA |
| ------------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------- |
| Telnyx | Voice and SMS termination, branded calling, SIP trunking | BAA in place for HIPAA-enabled workspaces. DPA on file. |
| Hiya | Number reputation analytics (via Telnyx) | DPA. Verified per deployment for HIPAA-strict customers. |
| LiveKit Cloud | Real-time media for browser-bridged calls only (see Media path below) | BAA in place for HIPAA-enabled workspaces. |
| Deepgram | Answer classification on outbound calls (person vs voicemail) | BAA in place. Not in the conversation path, and recordings are not transcribed after the call. |
| OpenAI | Realtime speech-to-speech voice model (default); every text feature — assistant, drafting, summaries, embeddings; internal tooling | BAA in place for HIPAA-enabled workspaces. |
| Google (Gemini) | Speech-to-speech voice model, selectable alternative | Routed through Google Cloud Vertex AI for HIPAA workspaces, under the Google Cloud BAA. |
| Vercel | Application hosting and storage (Blob) | BAA available on Enterprise. |
| Neon (managed Postgres) | Primary data store | BAA available; encryption and backup defaults documented. |
| Stripe | Billing | BAA available. PHI never appears in invoice metadata. |
| Resend, PostHog, Sentry, Upstash, Trigger.dev, Bytemine | Email delivery, product analytics, error monitoring, caching, job orchestration, contact enrichment | See the full list for scope and DPA status. |
## Media path
Voice agents run as containers on the LiveKit stack, and where that stack runs differs by call direction. It is worth understanding, because it determines which parties touch call audio.
| Call type | Media runs on today | Who is in the audio path |
| ---------------------------------------- | ------------------- | ------------------------------------------------------------------------------------------------- |
| Inbound AI calls | LiveKit Cloud | Telnyx for the PSTN leg, LiveKit Cloud for media and the agent runtime |
| Outbound AI calls | LiveKit Cloud | Telnyx for the PSTN leg, LiveKit Cloud for media and the agent runtime |
| Browser-bridged calls (augmented dialer) | LiveKit Cloud | Telnyx for the PSTN leg, plus LiveKit Cloud to join the operator's WebRTC leg to the same session |
We run LiveKit in two places: LiveKit Cloud, and a LiveKit stack our carrier operates inside its own network. Which one serves a given direction is a routing setting we move for reliability, so both are covered by BAA and DPA and both appear on the [sub-processor list](https://www.revdesk.com/subprocessors). Ordinary AI calls in both directions are served by LiveKit Cloud today; browser-bridged calls always are, which is inherent to that feature rather than a routing choice.
## Data residency
US default. Recordings, transcripts, and call metadata are stored in US regions. EU residency is available on Enterprise on a customer-by-customer basis. Talk to sales if your contract requires a specific region.
## Retention
| Object | Default retention | Override |
| --------------- | ----------------------------------------------------------------------------- | ---------------------------------------------------------- |
| Call recordings | 90 days. 30 days under HIPAA mode. | Customer-configurable per number, 7 days to 1 year, or off |
| Transcripts | Matches recording retention | Customer-configurable |
| Call metadata | Retained for the life of the workspace (needed for billing, analytics, audit) | Reduced on contract request |
| Audit log | Retained for the life of the workspace | Exportable on offboarding |
An automated retention job purges expired audio and transcripts and writes an entry to the data-deletion audit log for every run. Customer-initiated deletion is supported in-app and via the API, and removes the record along with its content. On account closure, deletion completes within 90 days, matching the DPA.
Stored files (recordings, voicemail audio, uploads) are removed from object storage at the point of deletion. Deleted database rows remain recoverable only within our managed Postgres change-history window, which is measured in days and never exceeds 30; past that the history is discarded permanently. That history is not restored into production to recover deleted customer data.
## Network controls
* IP allowlisting on the API for Enterprise.
* Branded calling at the carrier level with STIR/SHAKEN attestation. See [Caller trust](/concepts/caller-trust).
* DNC scrubbing and TCPA-aware sequencing run before every campaign dial leaves the platform: federal and org-level DNC lists, per-channel consent state, calling-window enforcement, and frequency caps are all evaluated per contact at dial time. Manually initiated dials from the dialer are not gated by campaign compliance rules, so the operator is responsible for them.
## SOC 2
SOC 2 Type II audit is in progress. Controls are mapped, evidence collection is underway, and the report will be available under NDA via sales when issued. Until then, the security packet covers the same control families and includes a gap analysis prepared by our auditors.
## HIPAA
PHI handling is gated by a per-workspace `hipaa_enabled` flag that activates only after you sign a BAA with RevDesk. The flag restricts LLM routing to BAA-covered providers (an ineligible selection is swapped to a covered default), routes Gemini through Vertex AI under the Google Cloud BAA, strips recordings and transcripts from outbound webhooks and the public API, defaults recording retention to 30 days across the workspace's numbers, and emits a compliance audit log.
HIPAA mode is a **compliance boundary, not a storage switch**. It guarantees every provider touching call content is BAA-covered and tightens the retention default; whether call content is recorded and retained at all remains the workspace's own decision via its recording and transcript settings. See [HIPAA and BAA coverage](/concepts/hipaa) for the full posture and how to request a BAA.
## Incident response
Customers are notified without undue delay, and in any event within 72 hours, of a confirmed material incident affecting data we process on their behalf — the commitment in § 7 of the DPA. Under HIPAA, affected covered entities are notified within 60 days of discovery per § 164.410. Where we are the controller, supervisory authorities are notified within 72 hours per GDPR Article 33. Post-incident reports include root cause, remediation, and prevention measures.
For unconfirmed events, the customer security contact on file is notified during the investigation, not after.
## Reach security
* General security questions: [security@revdesk.com](mailto:security@revdesk.com)
* Compliance and BAAs: [compliance@revdesk.com](mailto:compliance@revdesk.com)
* Vulnerability disclosure: [security@revdesk.com](mailto:security@revdesk.com) (PGP key in the packet)
Sent under NDA. Includes mapping to SOC 2, DPA, BAA addendums, and the latest security assessment summary.