Security

AI Model Training

We do not train models on your data. Your customer calls, audio recordings, transcripts, and messages are never used to train, fine-tune, or improve public or foundation artificial intelligence models. Our agreements with downstream speech-to-text and language model providers contractually bind them to the same restriction.

Data Isolation

Customer data is logically isolated by Organization ID at the database layer. Every database query, conversation log, contact record, and recording is strictly partitioned:

• Only authenticated users within your organization can access your transcripts and audio recordings.
• Queries and storage keys cannot cross tenant boundaries.
• Nuteq AI personnel do not access customer conversations except when explicitly requested by you for technical support.

Encryption at Rest and in Transit

All customer data and communications are protected with industry-standard cryptographic algorithms:

• Data at rest, including database storage, encrypted logs, backups, and audio recordings, is encrypted using AES-256.
• Web traffic, dashboard sessions, and API communications enforce HTTPS via TLS 1.3 and TLS 1.2.
• Telephony audio media streams use Secure Real-time Transport Protocol (SRTP).
• Browser-based voice calls use WebRTC DTLS to encrypt media end-to-end.

HIPAA Compliance & Healthcare Safeguards

For healthcare providers, medical clinics, and dental practices subject to HIPAA, Nuteq AI offers dedicated HIPAA-compliant enterprise deployment:

• Execution of formal Business Associate Agreements (BAAs) covering all Protected Health Information (PHI).
• Automatic PHI and PII redaction capabilities from call transcripts and audit logs.
• Isolated infrastructure with dedicated audit logging and compliance monitoring.

Storage and Audio Retention Controls

Transcripts, contact records, and metadata are stored in private databases within an isolated internal network with no exposed public database ports. Nightly backups are copied off-site to encrypted cloud storage for disaster recovery.

Call audio recordings are stored in private cloud storage and can only be played through an authenticated backend session by authorized members of your team. Raw audio storage URLs are never made public or exposed to client browsers. Customers can configure custom audio retention periods or delete recordings immediately upon review.

Logging

We do not write sensitive customer details, caller phone numbers, or conversation content into application debug logs. Integration credentials, tokens, and secrets are stored in dedicated credential vaults per organization and are never sent to the client browser.

Authentication

Account access is managed through a secure enterprise identity provider supporting passwordless email links, multi-factor authentication (MFA), and single sign-on (SSO). We do not store customer passwords. Role-based access control (Owner, Admin, Member) governs dashboard permissions.

Payment Data

Nuteq AI does not store payment cards. All billing and subscription details are managed directly through Stripe via the Stripe Customer Portal.