Security & privacy
Built for the data you are responsible for.
You are the data fiduciary; we process on your behalf. Everything below is how the platform works in production today.
Principles
Six things that hold on every request.
Your data stays yours
Every record is scoped to your tenant on every query. Prompts are not stored, and your data is never used to train models.
Keys you give us are guarded
CRM, help-desk and WhatsApp keys are encrypted at rest with a separate key, shown only as their last four characters, and read only at the moment of a call.
A person approves what matters
Outbound writes wait for approval, extracted documents go to review below a confidence floor, and an assessment roadmap is exported only after sign-off.
Everything is on the record
Every decision and privileged action is written to an immutable audit log, with personal data scrubbed.
Spend you control
Rate limits, per-agent daily caps and a monthly spend cap you set yourself — so a leaked embed or a runaway script cannot run up a bill.
Hosted in India
Production runs in Azure Central India. A private deployment keeps the database, secrets and documents on private endpoints inside your own network.
DPDP Act, 2023
Your customers' rights, in one call each.
When a person asks what you hold about them, or asks you to delete it, the platform answers across every agent and channel.
| Right | How it is fulfilled |
|---|---|
| Access — what do you hold about me? | POST /v1/privacy/export returns every record about one person across all agents and channels. |
| Erasure — delete my data | POST /v1/privacy/erase deletes conversations and threads and anonymises business records. |
| Correction | Made in your own CRM or help desk, the source of truth; our caches follow. |
| Grievance | Handled by your Grievance Officer; we assist within 72 hours. |
What is held, and for how long
| Data | Why | Kept |
|---|---|---|
| Support conversations (web, WhatsApp, phone transcripts) | Answer and escalate | Until you erase it, or on request |
| Voice audio | Speech recognition | Never stored — transcribed in memory |
| Leads and operations requests | Qualify, route, run workflows | You decide |
| Uploaded documents | Extraction and review | You decide; 7-day recovery after deletion |
| Integration keys | Act in your own systems | Until you disconnect |
| Audit log | Accountability | 90 days by default |
Controls
In place today.
- Scoped API keys, stored only as hashes
- TLS 1.2+ in transit; encryption at rest throughout
- Managed identities — no cloud passwords stored anywhere
- Webhooks signed with HMAC-SHA256 and a replay window
- Uploads checked by content, not by file name
- Every change verified by tests, type checks and migration checks before it ships
CrewTAC is not yet SOC 2 or ISO 27001 certified. The controls are in place and mapped to both frameworks; a readiness pack, our DPDP documentation and a data processing agreement are available on request.
Sub-processors
Who else touches your data.
| Sub-processor | Purpose | Where |
|---|---|---|
| Microsoft Azure | Hosting, database, storage, secrets | Central India |
| Google (Gemini) | Language model | Global |
| Sarvam AI | Indian-language speech, translation, OCR; optional India-hosted model | India |
| Voyage AI | Knowledge search embeddings | United States |
| Brevo | Transactional email | European Union |
| Meta · Exotel · Twilio | WhatsApp and phone channels, when you connect them | Varies |
| Razorpay | Online payment of rupee statements, when enabled | India |
Next step
Need the paperwork?
Our DPDP readiness pack, controls matrix and data processing agreement are available to customers and prospects under NDA.
Or email sales@crewtac.com
