What we have in place today to protect data across our voice agents, products, and engagements: where it lives, who processes it, how long we keep it, and how we respond to incidents.
Last updated: October 10, 2026
This page sets out what we have in place today to protect the data we handle, where that data lives, and which providers process it for us. It covers our voice agents, our products, and this website. For a specific deployment, the order form, the data processing agreement, and the security documentation we share during review set out the commitments that apply.
We do not hold SOC 2 or ISO 27001 certification today. We answer bank security questionnaires and share our architecture and policies under NDA.
These providers process personal data on our behalf:
| Provider | Purpose | Data | Location |
|---|---|---|---|
| Microsoft Azure | Hosting, storage, and AI services | Customer and call data for each deployment, including recordings and transcripts; this website | India by default, or the region agreed per deployment; this website in Southeast Asia |
| Speech and language AI provider | Speech recognition, speech synthesis, and language models for our voice agents | Call audio and transcripts | India |
| Twilio | Phone calls and messages | Phone numbers, call audio, and message content | United States |
| Resend | Email from our website forms | What you submit through our contact and job application forms | United States |
| Microsoft Bookings | Meeting booking on our contact page | Your name, email, and the meeting details you enter | Microsoft cloud |
| Google reCAPTCHA | Spam protection on job applications | Browser and interaction signals collected by Google |
Each deployment’s data-processing agreement names every provider and its terms. Other AI model providers process data only where a customer has agreed to them in writing.
We process personal data in line with our Privacy Policy. For deployed products and client engagements, we typically act as a data processor under a data processing agreement, handling data on behalf of and under the instructions of our customers. We use customer data only to provide the services the customer instructs. We do not use it, including call recordings and transcripts, to train or fine-tune AI models, or to improve services for anyone else, without the customer’s prior written consent.
We protect data in transit and at rest:
Access is scoped, authenticated, and auditable:
Availability targets, support hours, and response times for a production deployment are set out in the order form or service level agreement for that deployment.
For AI systems, quality and oversight are first-class controls:
Our collections agent tells the borrower at the start of every call that it is a virtual assistant and that the call is recorded, and discusses dues only after the borrower’s identity is confirmed. It hands the call over to the collection officer when the borrower asks for a person, and every recovery call gives the borrower a grievance contact. Recovery calls are placed only between 08:00 and 19:00 IST, and every line the agent speaks is checked against banned phrases, including threats and any mention of police, family or employer.
If we confirm a security incident that affects a customer’s data, we tell that customer without undue delay. We report cyber security incidents to CERT-In within six hours of noticing them, as Indian law requires.
If you believe you have found a security vulnerability in our website or products, please report it to us at contactus@turingedge.ai with enough detail to reproduce the issue. The same contact is published in our security.txt file. We appreciate responsible disclosure and will work to acknowledge and address valid reports promptly. Please do not publicly disclose an issue until we have had a reasonable opportunity to respond.
For security questions or documentation requests, contact us:
