Protection appropriate to the service
Security covers account access, separation between customers, infrastructure, communications, AI processing and the people operating the service. The DPA protection schedule requires appropriate technical and organisational measures under Article 32, taking account of the processing and risks to individuals.
Those requirements include authorised access for the correct business, confidentiality, limited administrative privileges, appropriate protection in transit and at rest, protected credentials, provider-event authenticity, controlled changes, incident handling and recovery. They are contractual requirements, rather than a claim that a particular certification or fixed recovery target applies.
Customer data, AI and retention
Keep business knowledge and action context limited to the authorised reception purpose. Do not import unrelated personal records, credentials or unnecessary sensitive documents. Live audio processing still occurs when saved audio is disabled. Recordings, transcripts, summaries, tickets, notifications and delivery records are separate copies with their own purpose and handling requirements.
Useful history may be retained for documented enquiries, follow-up, accuracy and complaint purposes. Review full-content need when enquiries or follow-up close and when the purpose or relationship changes. An active subscription is not permission to keep every recording indefinitely. Archiving a record is not erasure.
The DPA requires return or deletion at the customer’s choice at processing end, deletion of copies unless UK law requires storage, and controlled backup expiry with deletion reapplied before restoration to use. Earlier lawful rights instructions still apply.
We do not claim universal UK-only processing, zero retention or that every provider never uses information for model training. The actual supplier roles, settings and permitted purposes must match the agreed processing arrangements. A service-improvement phrase is not unrestricted authority to reuse caller content.
Steps your business should take
- Protect sign-in credentials, authorise only people who need access and remove access when authority ends.
- Review business facts, approved transfer destinations and message links before routing customer interactions to the service.
- Review material outcomes and changes, and use authorised testing within your trial or agreed service.
- Preserve the required AI, provider, recording and privacy entry notices; supply your business-specific information and required permissions.
- Keep a human route for important enquiries and an emergency-capable alternative. ElevenAgents cannot reach 999 or 112.
- Report suspected compromise, a wrong recipient or inappropriate information promptly, sharing only what is necessary.
Availability and recovery
Calls and messages depend on telephone networks and other suppliers, and can be disrupted, delayed or fail. Keep replacement routing and an appropriate fallback contact available. No fixed uptime, support-response or recovery-time SLA is included unless separately agreed.
The DPA requires appropriate resilience, protected backups, an ability to restore access in a timely manner and regular assessment of effectiveness. A supplier outage does not automatically remove Open Voice Agent’s responsibilities or remedies under the service terms.
Report a security concern
Email team@openvoiceagent.com; “Security concern” in the subject can help route the message but is not mandatory. Include the affected feature, what you observed, an approximate time and safe reproduction details. Do not attach passwords, tokens, full recordings or other people’s personal records. We can arrange an appropriate route for sensitive evidence.
Do not access another person’s account, extract data, disrupt calls or test against live customers to demonstrate a problem. Reporting does not authorise intrusive testing or create a paid bug-bounty arrangement.
For a breach affecting customer information processed by Open Voice Agent, the DPA requires notification to the customer without undue delay after awareness, with further information in stages as necessary. A regulatory reporting period does not postpone that notification. Each applicable reporting duty is assessed separately.
Assurance and contact
No SOC 2, ISO 27001, HIPAA, penetration-test or independent compliance certification is claimed for Open Voice Agent here. If you need particular assurance, contact us to establish the available evidence and suitability before supplying sensitive information.
General, privacy and security enquiries use team@openvoiceagent.com. Billing and cancellation use billing@openvoiceagent.com. Company telephone: 020 4524 7953. No fixed staffed hours or phone-answering promise is included. Read the privacy notice, DPA and provider directory together.