Your calls are your most sensitive data
We treat security as the first feature. Here is exactly how your data is protected.RevCycle records customer conversations, so we treat security as the first feature. Here is exactly how your data is protected.
Type II
& CCPA
256
1.3
Security principles
No training on your data
Your calls never train our models or anyone else's. Zero-retention agreements cover every provider.Your calls never train our models or anyone else's. Model providers process your data under zero-retention agreements.
You own the data
Export everything at any time. Ask us to delete it and it is gone within 30 days.Export recordings, transcripts, and CRM history at any time. Ask us to delete everything and it is gone within 30 days.
Least access by default
Recordings are visible only to the rep and their team. Our production access is scoped and logged.Recordings are visible only to the rep and their team. Production access inside RevCycle is scoped, logged, and reviewed.
Enterprise-grade, on every plan
- Encryption at rest · TLS 1.3
- SSO / SAML · SCIM
- Audit logs · role-based access
- EU or US data residency
- Annual penetration tests
What happens to a call
- 01
Recorded with consent
The notetaker announces itself on every call.The notetaker announces itself on every call. Consent rules follow the strictest region of any participant.
- 02
Encrypted and processed
Encrypted on arrival, summarized, written to your CRM.Audio is encrypted on arrival, transcribed, summarized, and written to your CRM. Zero-retention agreements cover every model provider.
- 03
Retained on your terms
Custom retention windows on Enterprise.Default retention follows your plan; Enterprise sets custom windows per workspace, down to transcript-only.
- 04
Deleted, verifiably
Deletions cascade through backups within 30 days.Deletions cascade through backups within 30 days. You receive a deletion certificate on request.
Security questions
In AWS, in the region you choose at setup: EU (Frankfurt) or US (Virginia). Data never leaves your region.
No one, by default. Support access requires your explicit approval per incident, is time-boxed, and every action is logged.
No. Not ours, not our providers'. Zero-retention agreements are in place with every model provider we use.
Email security@userevcycle.com. We acknowledge within 24 hours and run a coordinated disclosure program.
Bring your security team in
Start on your own calls, then share the architecture and the SOC 2 report with them. Hard questions answered in writing.