Security & Compliance

Trust Center

Security, compliance, and data protection are foundational to everything we build.

Last updated: March 2026

Infrastructure & Hosting

EU-hosted in Frankfurt (eu-central-1). Powered by Supabase (PostgreSQL) with Vercel Edge Network for global performance. Customer data is stored in the EU; AI analysis involves US sub-processors under safeguards (see DPA).

Region: EU (Frankfurt, eu-central-1)
Database: Supabase (PostgreSQL 15)
CDN: Vercel Edge Network (300+ PoPs)
Data storage: EU (US sub-processors per DPA)

Data Encryption

TLS 1.3 for all data in transit. AES-256 encryption at rest for all database storage (Supabase default). No unencrypted data leaves our systems.

In transit: TLS 1.3 (HTTPS enforced)
At rest: AES-256 (Supabase default)
Backups: Encrypted, daily, 30-day retention
Key management: Provider-managed keys

Authentication & Identity

OAuth 2.0 with PKCE flow. SSO/SAML 2.0 for enterprise organizations (Roadmap Q3 2026). Multi-Factor Authentication (MFA) available for all accounts. Org-wide MFA enforcement for admins. All tokens hashed with SHA-256.

OAuth 2.0 with PKCE
SSO/SAML 2.0 (Roadmap Q3 2026)
MFA support (TOTP)
Org-wide MFA enforcement
SHA-256 token hashing

Access Control

Role-Based Access Control (RBAC) with 4 roles: Super Admin, Admin, Closer, Setter. Row-Level Security (RLS) enforced on all Supabase tables. Scope-based API keys with granular permissions.

4 RBAC roles: Super Admin, Admin, Closer, Setter
Row-Level Security (RLS) on all tables
Scope-based API keys
Principle of least privilege

API Security

Rate limiting with fail-closed design. HMAC-SHA256 webhook signing for all outbound webhooks. SSRF protection on all server-side requests. All API endpoints require authentication.

Rate limiting (fail-closed)
HMAC-SHA256 webhook signing
SSRF protection
Authentication required on all endpoints

Privacy & Compliance

Fully GDPR compliant. Data Processing Agreement (DPA) available on request. Data Protection Impact Assessment (DPIA) completed for AI profiling features. 15 compliance documents maintained in our GDPR Center. Cookie consent with granular category controls.

GDPR / DSGVO compliant
DPA available on request
DPIA for AI profiling (Art. 35)
15 compliance documents
Granular cookie consent

AI Data Handling

PII pseudonymization before any external AI processing. AI scoring opt-out available under GDPR Art. 22. Betriebsrat gate for German organizations deploying AI performance scoring. No personal data is used to train third-party AI models.

PII pseudonymization before AI processing
Art. 22 opt-out for AI scoring
Betriebsrat gate (German orgs)
No data used for third-party model training

Monitoring & Incident Response

Automated breach notification system (Art. 33-34 GDPR). Configurable data retention engine with automatic cleanup. Comprehensive audit logging for all sensitive operations. 72-hour breach notification tracking.

Breach notification (Art. 33-34)
Data retention engine with auto-cleanup
Audit logging for sensitive operations
72-hour breach notification tracking

Provable, Not Just Claimed

These safeguards are implemented in the product itself — verifiable in behavior, not just written in a policy.

PII pseudonymization before AI analysis

Before transcripts are sent to an AI provider, personal identifiers are replaced: names become [CONTACT_NAME], email addresses [EMAIL_1], phone numbers [PHONE_1].

Self-service GDPR export & deletion

Every account can export its personal data (Art. 15 & 20 GDPR) and trigger full deletion (Art. 17) — including audio recording artifacts — directly from the account.

Automated retention with audit trail

Deletion deadlines run automatically: call recordings after 12 months, transcripts and analyses after 6 months, audit logs anonymized after 24 months. Every run is logged.

EU data storage (Frankfurt)

Customer data is stored on Supabase/AWS in Frankfurt (eu-central-1). AI analysis involves US sub-processors — see the full sub-processor list in our DPA.

Recording consent gate

A call recording cannot technically start without documented consent. Consent is stored with timestamp, method, and revocation support.

Encrypted backups

Automated daily database backups, AES-256 encrypted, 30-day retention.

What we don't have (yet)

No SOC 2 or ISO 27001 certification yet — both are on our roadmap. We would rather tell you that honestly than imply certifications we do not hold.

Compliance

GDPR

Compliant

Uptime, Backup & Business Continuity

Uptime SLA

99.9% Target

Vercel Edge Network with 300+ PoPs. Automatic failover and global CDN distribution. See our SLA for full details.

Backup Policy

Daily Encrypted

Automated daily backups with AES-256 encryption. 30-day retention period. Point-in-time recovery available on Enterprise plans.

Disaster Recovery

RTO < 4h

Multi-region infrastructure with automated recovery procedures. Recovery Time Objective under 4 hours. Recovery Point Objective under 1 hour.

Security Contact

For security inquiries, vulnerability reports, or to request compliance documentation:

security@isale.deals

DIAS SALES SOLUTIONS - FZCO, Dubai, UAE | Response within 48 hours