Infrastructure Security
Every layer of our platform is designed with security-first principles.Encryption
AES-256 encryption at rest, TLS 1.3 in transit. All voice data, transcripts, and customer information are encrypted end-to-end throughout the entire call lifecycle.Access Control
Role-based access control (RBAC) and least-privilege principles across all systems. Every access event is logged and auditable.Monitoring & Detection
24/7 security monitoring with intrusion detection systems, anomaly alerts, and comprehensive audit logging for all system activities.Business Continuity
Automated backups, disaster recovery procedures, and 99.9% uptime SLA. Redundant infrastructure across multiple availability zones.Incident Response
Documented incident response plan with defined escalation procedures, 72-hour GDPR breach notification compliance, and post-incident analysis.Vendor Security
All AI sub-processors (ElevenLabs, OpenAI, Deepgram, Cartesia) are vetted for security compliance. ElevenLabs Enterprise partnership enables EU-routed voice processing.1. Our Sovereignty Commitments
To meet the strict requirements of the European market (including Art. 9 GDPR for healthcare and sensitive sectors), we operate under four core principles:2. System Status & Availability
Transparency regarding our system performance is key to a reliable partnership. You can monitor our live status at any time: Live Status Monitor: https://status.famulor.io/3. Infrastructure & Platform Hosting
These providers host the Famulor.io platform, including the backend logic, databases, and customer dashboard.4. Artificial Intelligence (LLM)
These models handle the reasoning and conversation logic. We utilize Enterprise-grade instances to ensure data isolation and sovereignty. Note: LLM, STT, TTS, and SIP trunk providers are optionally selectable per assistant, depending on the use case.5. Speech Services (STT & TTS)
Specialized providers for real-time transcription (Speech-to-Text) and voice synthesis (Text-to-Speech). Note: LLM, STT, TTS, and SIP trunk providers are optionally selectable per assistant, depending on the use case.6. Business Operations & Billing
Providers used for transactional security and administrative management.7. WhatsApp Business Processing
For WhatsApp Business, the following applies:- WhatsApp is integrated via the Twilio connection.
- You can use either your own WhatsApp-enabled phone number or a number from the Famulor number pool (depending on setup/verification).
- If you use your own number, the number owner must complete verification directly in Meta Business Manager.
- Incoming WhatsApp messages are processed via configurable LLM workflows.
- Responses are returned as an AI-generated reply.
- Text, images, and voice messages can be processed within the enabled assistant configuration and used for response generation.
8. Website Analytics & Tag Management
For website and product analytics, we use:9. Providers: Legal Entity & Address
Below is the legal entity we use for each provider, including publicly listed company address information (as of March 2026).10. International Data Transfers & Safeguards
For providers with US-based parent companies (e.g., Microsoft, Google, Vercel, Soniox), Famulor ensures compliance via:- Data Residency: Configuring services to process data exclusively on EU-based nodes.
- Legal Frameworks: Utilization of the EU-U.S. Data Privacy Framework (DPF) and/or Standard Contractual Clauses (SCCs).
- Enterprise Agreements: Specialized contracts that prevent third-party access and data usage for model training.
- TIA upon request: For Enterprise customers, Famulor provides a Transfer Impact Assessment (TIA) upon request in line with EDPB Recommendations 01/2020 for all providers with a US parent company. The TIA documents implemented safeguards and the legal risk assessment of the third-country framework.
Transfer Legal Basis per US Provider
For all providers without DPF certification (Deepgram, Soniox, Gladia, Cartesia, LiveKit), Famulor has executed the EU Standard Contractual Clauses under European Commission Decision 2021/914/EU (Module 2: controller to processor). These are available to Enterprise customers upon request.
To independently verify DPF certifications of individual providers, see the official list: Data Privacy Framework Participants List
11. Data Retention
Retention periods are available in the account settings and configurable per data category.12. Technical and Organizational Measures (TOMs)
Our security framework is designed for maximum accountability and isolation:13. Governance & Maintenance
- This list is reviewed quarterly.
- Changes to the provider stack are documented in the changelog.