Security that scales with you.
Vanta-monitored controls, SOC 2 / HIPAA / GDPR alignment, and optional AI accent neutralization on voice. Raw US PII never leaves AWS us-east-1 — tokenized at the US edge, the agents behind your pod only ever see the redacted view.
Every ticket, call, and chat follows the same path.
No exceptions. No back-channels. No shadow access. The diagram below is exactly what runs in production.
US Customer
Tickets and calls originate from the end customer and travel encrypted to our US ingress.
US Edge — Redaction Layer
PII is tokenized before it leaves the United States. Credit cards → tokens. SSNs → masked. Names & addresses → pseudonymized.
Encrypted Tunnel
Only the redacted ticket payload crosses the border. No raw PII ever leaves US infrastructure.
Medellín Agent
Agents see a redacted view only. No local storage, no USB, no print. Every action is audited.
- name: Sarah Whitman
- email: s.whitman@acme.com
- card: 4242 4242 4242 9821
- ssn: 412-55-7790
- addr: 142 Hudson St, NYC
- name: Customer #80214
- email: ••••••@acme.com
- card: tok_1Q••••9821
- ssn: •••-••-••••
- addr: NYC, NY (zip 10013)
No badges we haven't earned.
We list what's active, what's in progress, and what's on request — never a blue checkmark we can't back up with paperwork.
Vanta-monitored controls
Continuous control monitoring via Vanta — security, availability, and confidentiality evidence collected automatically, 24/7.
SOC 2 Type II
Annual third-party audit covering security, availability, and confidentiality. Type I report available now under NDA.
HIPAA-aligned workflows
PHI is redacted on US infrastructure before any cross-border processing. We sign BAAs for healthcare clients.
GDPR data residency
EU customer data can be pinned to AWS eu-west-1. Cross-border transfers governed by SCCs and DPAs.
PCI-DSS scope reduction
Card data is tokenized at the US edge before any agent sees it. Your PCI footprint shrinks from 'full PAN' to 'token reference'.
SSO + MFA
Bring your IdP — Okta, Entra, Google. MFA enforced on every account. Quarterly access reviews, signed off in writing.
The eight controls that keep humans accountable.
Controls aren't theoretical here — every one below is enforced by tooling, not policy. If it's not enforced, it's not on the list.
Locked endpoints
No USB, no print, no local storage. Mac/Windows MDM-managed.
Continuous screen recording
Every agent station recorded. 12-month retention. Searchable on demand.
MFA everywhere
Every internal tool, every client login. Phishing-resistant where supported.
Role-based access
Agents see redacted ticket views only. Least-privilege enforced by default.
mTLS tunnels
All cross-border traffic over mutual-TLS, IP-allowlisted, certificate-pinned.
Quarterly access reviews
Joiners-movers-leavers documented. Sign-off by US account manager.
Annual pen test
Independent third-party. Executive summary shareable under NDA.
Background-checked agents
Criminal + employment verification. Signed NDA before keyboard access.
If something goes wrong, here's exactly what happens.
Written, drilled quarterly, and shareable with your security team in advance — not after the fact.
Detect
SIEM alert + on-call paged. Ticket opened, severity assigned.
Contain
Affected access revoked, sessions killed, evidence preserved.
Notify
Customer notification with scope, timeline, and known impact.
Remediate
Root-cause fix shipped. Postmortem drafted.
Report
Written postmortem + control changes delivered to affected customers.
The documents your security team will ask for.
Half of these are downloadable today. The rest are one signed NDA away.
- DPA (Data Processing Agreement)Pre-signed · downloadable
- SCCs (EU Standard Contractual Clauses)Pre-signed · downloadable
- BAA (HIPAA Business Associate Agreement)On request · 5 business days
- SOC 2 Type I reportUnder NDA · request access
- Penetration test executive summaryUnder NDA · request access
- Sub-processor listPublic · always current
Every vendor that touches your data.
Listed, with purpose and region. Always current.
Want the full audit pack?
DPA, SCCs, SOC 2 Type I, and pen-test summary — sent in one email after a 5-minute NDA.