Security

How SvaraCall protects your data

A plain-language summary of our current practices. For the legal detail see the Privacy Policy, Data Processing Addendum and Compliance pages.

Data residency

Call recordings and transcripts are stored at rest on AWS in Mumbai, India. Account, billing and uploaded contact-list data sit on India-region cloud infrastructure.
SvaraCall is not a fully in-country stack: some subprocessors, including language model inference and parts of the hosting and monitoring layer, process data outside India. If you need full in-country processing, contact us before you sign.

TODO(Sarwan): confirm the wording of the out-of-India processing disclosure, and decide whether to publish the subprocessor list (currently available on request only).

Encryption

Data in transit is encrypted with TLS.
Databases and stored credentials are encrypted at rest, and call recordings are encrypted in storage. API keys and authentication tokens are held in secrets management, encrypted at rest.

TODO(Sarwan): key management approach (who holds keys, rotation cadence) and any cipher / TLS-version specifics you want to state.

Retention

Call recordings, transcripts and campaign data are retained for a period set by the customer, within platform defaults and maximums.
Platform and API logs are kept for 90 days and security and audit logs for 12 months. Account and profile data is kept for the life of the account plus 90 days.
For 30 days after termination you may request a machine-readable export; afterwards Customer Data is deleted or irreversibly anonymised.

TODO(Sarwan): platform default and maximum retention for recordings and transcripts, and the deletion timeline you want to promise.

Access control

Role-based access control and least-privilege access to production, with audit logging of administrative actions and separation of environments.
Recording playback and export can be limited to authorised roles.
Inbound webhooks are verified with HMAC.

TODO(Sarwan): customer-facing controls (SSO, MFA, IP allow-listing, per-workspace roles) that are actually shipped today.

DPDP approach

Customer data is handled in line with the DPDP Act. SvaraCall calls only contacts who have consented and stops the moment someone opts out.
Breaches are notified to the Data Protection Board of India, affected Data Principals and, where required, CERT-In; as a processor we notify the relevant customer without undue delay.

TODO(Sarwan): controller vs processor split for customers, grievance-officer contact, and your data-principal request (access / erasure) process.

Telecom compliance (TRAI / DLT)

Calls go out on DLT-registered templates and headers approved for your sender identity, with consent-first dialing, immediate opt-out handling and a recording disclosure at the start of every call.

TODO(Sarwan): DND / NCPR scrubbing approach, calling-hour windows, and how customers register their DLT entity and headers with you.

Certifications roadmap

We are not currently ISO 27001 certified or SOC 2 attested, and we do not claim certifications we do not hold.
Our security roadmap, including target dates for independent assessment, is available on request under NDA.

TODO(Sarwan): which standards you intend to pursue and target quarters, if you are willing to publish them.

Hear it call.

We'll place a live SvaraCall to your own phone, in Telugu, Hindi, or English.

Get a demo on your phone

Get a demo call

For pricing and a demo, please contact contact@svaracall.com