Security and compliance
How we handle call audio, transcripts and account data, which checks run before an outbound call is placed, and what stays your responsibility.
How calls and data are handled.
What happens to the audio, the transcript and the records once a call ends.
- Data region
- United States. Customer data is stored in the US.
- Audio in transit
- Browser call audio is encrypted in transit between the browser and the call engine (DTLS-SRTP).
- Recordings at rest
- Encrypted before they are stored, with a separate key for each customer.
- Recording notice
- Callers hear a recording notice on every call, inbound and outbound. It cannot be turned off.
- Recording on or off
- Recording is on by default. You can switch it off for each agent.
- How long it is kept
- Recordings 90 days and transcripts 1 year by default. You can shorten both.
- Compliance records
- Call metadata, consent, Do-Not-Call and compliance events are kept for 5 years and cannot be deleted by the customer.
- Model training
- Your calls are not used for training unless you opt in. It is off by default.
- Subprocessors and DPA
- A data processing agreement and a subprocessor list are published at launch.
Six checks before the phone rings.
Every outbound call passes the same six checks. If one fails, the call is not placed, and the reason is logged for you.
- Verified businessBefore an account can place outbound calls, the business behind it is verified. Accounts that are not verified can only receive calls.
- Consent on fileThe contact needs a consent record on file: how and when they opted in, and what they agreed to. No record, no call.
- Do-Not-Call scrubThe number is checked against your Do-Not-Call list and the Larynth opt-out list, which keeps every request to stop calling.
- Calling hoursCalling hours are checked for the contact’s state and local time. Outside the allowed window, the call waits.
- AI disclosureThe agent says it is an AI assistant at the start of the call and names the business it calls for.
- Encrypted recordingCallers hear a recording notice. Audio and transcripts are encrypted and stored in the US, and you choose how long they are kept.
Who is responsible for what.
The checks help, but they do not make a call lawful on their own. Larynth does not promise compliance, and your legal responsibility stays with you.
What Larynth does
- Verifies the business before it can place outbound calls.
- Stores consent records and Do-Not-Call lists for you.
- Keeps a Larynth-wide opt-out list and applies it to every account.
- Plays the recording notice and the AI disclosure.
- Blocks outbound calls to emergency numbers (911).
What stays with you
- You are the caller, and you are responsible for following the laws that apply to your calls.
- You bring your own Do-Not-Call registrations for outbound campaigns.
- You only call people who have given the consent your calls need.
- You tell your own staff that calls are recorded.
- You review the terms and acceptable use policy for your situation.
Certifications and reports
- SOC 2
- — Not available yet.
- HIPAA
- — Not available yet.
- Penetration test report
- — Not available yet.
Security questions or a report: support@larynth.com. Service status is at status.larynth.com.