Trust Center

At Famulor, data sovereignty is a baseline requirement of modern AI communication. This Trust Center gives full transparency into our infrastructure, our specialized sub-processors, and the technical safeguards that protect sensitive data. This page serves as a living annex to our Data Processing Addendum (DPA) and is updated regularly to match our current technology stack. Terms like LLM, STT, TTS, SIP trunk, or realtime model are explained in the Glossary.

Infrastructure security

Every layer of our platform is built on security-first principles.

Encryption

AES-256 encryption at rest, TLS 1.3 in transit. Voice data, transcripts, and customer information are encrypted end-to-end across the full call lifecycle.

Access control

Role-based access control (RBAC) and least-privilege principles across all systems. Every access is logged and auditable.

Monitoring & detection

24/7 security monitoring with intrusion-detection systems, anomaly alerting, and comprehensive audit logging for all system activity.

Business continuity

Automated backups, disaster-recovery procedures, and a 99.9% availability SLA. Redundant infrastructure across multiple availability zones.

Incident response

A documented incident-response plan with defined escalation procedures, compliance with GDPR’s 72-hour breach-notification requirement, and post-incident review.

Sub-processor security

Every AI sub-processor is reviewed for security and compliance before it’s added to the platform. Native, EU-resident plugins are used wherever available for the highest-sensitivity workloads (see Speech services below).

1. Our sovereignty commitments

To meet the strict requirements of the European market — including GDPR Art. 9 for healthcare and other sensitive-data use cases — we operate on four principles:

Zero Data Retention (ZDR)

Zero Data Retention (ZDR) applies by default to model requests routed through our managed voice AI. You do not need an Enterprise plan. The service and its model providers process prompts, audio, and model responses to complete the request. They do not log that content, retain it after the request, or use it to train models. This covers speech recognition, language models, speech synthesis, and realtime models when they use this route. The following data and services are separate:

• Workspace data: Call history, recordings, transcripts, and messages follow the workspace data retention rules.
• Session diagnostics and voice samples: Diagnostics follow their own retention policy. Voice cloning stores the samples needed to reuse a voice.
• Other model routes: Direct provider connections and other services follow their own retention and training terms.

If you need a 0-day retention period for data Famulor stores in your workspace, contact our Enterprise team to review which data and settings this can cover.

AI inference region (workspace setting)

Under Settings → Workspace, AI inference region selects Global, EU or US for workspace AI processing. The model catalog is filtered to endpoints available in the selected region.

• EU: limits the catalog to models with EU endpoints available through Famulor.
• US: limits the catalog to eligible US endpoints and explicitly marked global routes.
• Global: automatic routing without an EU-only or US-only restriction. Voice processing uses the nearest available location.

Famulor SIP trunks are available in the EU and US. For assistant calls on Famulor-purchased numbers, changing the workspace region automatically switches inbound and outbound SIP routing: EU uses the EU route; US uses the US route. BYO SIP trunks, verified caller IDs and Loop phone routes retain their separate routing settings. Model processing, media transport, telephony, agent hosting, and storage have separate region controls. Selecting EU in your workspace does not by itself keep the entire workflow in the EU. See AI regions & models for model endpoints, SIP routing, and infrastructure locations.

2. System status & availability

Transparency about system performance matters to us. You can check live status and historical uptime per service at any time: Status page: https://status.famulor.io/ Subscribe on that page for incident updates. Historical uptime is shown per service. The platform availability target is 99.9% (see Business continuity).

3. Infrastructure & platform hosting

These providers host the Famulor platform, including backend logic, databases, and the customer dashboard. The workspace AI region controls model selection. App hosting, database storage, and session diagnostics have separate settings. See AI regions & models for network locations and model endpoints.

Private Links

A private link is a closed connection between the voice agent and a service that is not open on the public internet. The agent runs in the Voice Agent Worker. Instead of calling a public web address, it reaches that service through the cloud provider’s own private network (AWS PrivateLink or Azure Private Link). The service stays inside its cloud account. That account approves the connection once and can turn it off later. The address the agent uses works only from inside the running agent, not from a browser on the open internet. The connection is encrypted with TLS. Famulor uses private links for this. A link is available in the same region as the voice agent: Frankfurt (eu-central) and Ashburn (us-east).

HIPAA

Famulor is HIPAA compliant. For a Business Associate Agreement or any other detail, email sales@famulor.io.

4. Artificial intelligence (LLM)

Depending on the model and mode, Famulor routes voice assistant requests through a managed model service or directly to a provider. Messaging replies, summaries, and other platform tasks can use Vercel AI Gateway. See Zero Data Retention for how retention differs by route. Note: The LLM provider is set automatically by the platform for most workspaces (see the standard table below) and is not manually selectable. Only workspaces with the AI Safety & Control add-on (“Automatic model fallback chains plus configurable guardrails for production reliability”) can choose the provider per assistant and configure additional fallback chains. Standard (without the AI Safety & Control add-on): Additionally selectable with the AI Safety & Control add-on: Platform-internal AI tasks (independent of the add-on):

5. Speech services (STT & TTS)

Specialized providers for real-time transcription (speech-to-text) and speech synthesis (text-to-speech). Famulor’s engine-mode architecture (Pipeline / Realtime / Half-Cascade) determines which of these run for a given assistant. The realtime infrastructure (LiveKit) and the object storage (AWS) behind it are listed in section 3. Note: The STT provider (transcription) — like the LLM — is set automatically by the platform and is not manually selectable without the AI Safety & Control add-on. The TTS provider (voice synthesis, voice selection) can be chosen by any user regardless of the add-on — only the voices/providers available in the workspace region selected under AI inference region are shown. SIP trunk providers are selectable per assistant, depending on the use case.

6. Business operations & billing

Providers for transactional security and administrative management.

7. WhatsApp Business processing

For WhatsApp Business:

• The integration connects directly to Meta’s WhatsApp Cloud API — not routed through Twilio.
• You can use either your own WhatsApp-enabled number or a number from the Famulor number pool (depending on setup/verification).
• If using your own number, the number owner must complete verification directly in Meta Business Manager.
• Inbound WhatsApp messages are processed through configurable LLM workflows.
• Replies are sent back as an AI-generated message.
• Text, images, and voice messages can be processed within the enabled assistant configuration and used for reply generation.

8. Platform analytics

For product analytics on the dashboard itself, Famulor uses: For Famulor’s own advertising measurement, the app also reports successful sign-ups, plan activations and purchases as conversions to Meta (Conversions API), Google Ads, Google Analytics 4 and Microsoft Advertising when marketing consent is given. These events concern your Famulor account, not content from calls or chats. Details are in the privacy policy.

9. Provider legal entities & addresses

The legal entity behind each provider, with a publicly available business address (as of the date below). Newer providers added since our last full review are marked — ask Milian for their current entity details pending the next quarterly update.

10. International data transfers & safeguards

For providers with US parent companies (e.g. Microsoft, Google, Vercel, Groq, ElevenLabs, Deepgram, Cartesia, LiveKit, AWS, Cloudflare), Famulor ensures compliance through:

• Data residency: selecting regional endpoints and reviewing the location of each service separately.
• Legal framework: use of the EU-U.S. Data Privacy Framework (DPF) and/or Standard Contractual Clauses (SCCs).
• Enterprise agreements: contracts that exclude third-party access and model-training use of your data.
• TIA on request: for enterprise customers, Famulor prepares a Transfer Impact Assessment (TIA) on request, per EDPB Recommendations 01/2020, for any provider with a US parent company.

Transfer legal basis per US-based provider

For providers without DPF certification, Famulor has executed the EU Standard Contractual Clauses under EU Commission Decision 2021/914/EU (Module 2: Controller to Processor). These are available to enterprise customers on request. To independently verify a provider’s DPF certification: Data Privacy Framework Participants List

11. Data retention

Depending on your plan, you can set retention periods per channel in Data Retention. The standard range is 1–24 months. With a 0-day period, eligible workspace data is due for deletion during the daily cleanup. Famulor can still store it until cleanup.

12. Technical and organizational measures (TOMs)

Our security framework targets maximum traceability and isolation:

13. Governance & maintenance

• This list is reviewed quarterly.
• Changes to the provider stack are documented in the Changelog.

Last updated: 2026-11-12

14. Google API disclosure

Where Famulor’s Google Calendar and other Google Workspace integrations use information from Google APIs, that use and any onward disclosure to other applications complies with the Google API Services User Data Policy, including its Limited Use requirements.

Related pages

• Support
• Enterprise
• Data retention settings