Compliance & Trust

1. Overview

This page summarizes the Viantrix compliance posture across our Platform, Console, APIs, SDKs, Telephony (PSTN/SIP), webhooks, and integrations. It is designed to help customers evaluate controls, certifications, and evidence relevant to their obligations.

• Jurisdiction overlays: EU/UK GDPR, India DPDP 2023, US CCPA/CPRA.
• Telecom rules: TRAI/DLT (India), TCPA/TSR (US), EU ePrivacy.

2. Certifications & Attestations

3. Security Controls Summary

• Encryption in transit/at rest; tenant isolation; RBAC and least-privilege access.
• Key management and secrets hygiene; hardened baselines; dependency scanning.
• SAST/DAST; vulnerability SLAs and remediation tracking.

{
  "controlId": "ENCR-AT-REST",
  "frameworks": ["ISO27001:A.8", "SOC2:CC6.1"],
  "owner": "Security",
  "evidence": "KMS policy, CMK rotation logs",
  "review": "Quarterly"
}

4. Privacy & Data Protection

See our Privacy Policy for lawful bases, DPIA guidance, retention, data subject rights, and Global Privacy Control (GPC) handling where required.

5. Data Residency & Sovereignty

Project-level regional hosting (e.g., India/EU/US) may be available at the tenant level: {{RESIDENCY_OPTIONS}}. Telephony routing may transiently traverse other regions due to carrier interconnects; transfers are protected by SCCs/UK IDTA/adequacy where applicable.

6. Telephony & Communications Compliance

• India (TRAI/DLT): Header/template registration, consent capture, opt-out logging.
• US (TCPA/TSR): Prior express consent for marketing; internal & national DNC compliance.
• EU ePrivacy: Consent for non-essential communications; transparency requirements.
• Caller ID Branding: Best-effort; carrier/device dependent; customer must use lawfully.
• Voicemail Detection: Probabilistic; confirm outcomes before automated actions.

7. AI Governance & Model Risk

• Model purpose limits; input/output logging; optional redaction; fairness checks where applicable.
• Human-in-the-loop for high-risk workflows.
• Model improvement policy: {{MODEL_IMPROVEMENT_POLICY}}.
• Training on customer inputs: {{TRAINING_ON_CUSTOMER_INPUTS}}.

8. Subprocessors & Vendor Risk

Vendors undergo security and privacy reviews, DPAs, and (where applicable) SCCs/IDTA. You control optional integrations you enable.

9. Vulnerability Management & Pen Testing

• Automated scanning cadence; CVSS-based SLAs; remediation tracking with ticketing.
• Independent penetration tests on a periodic basis.
• Coordinated vulnerability disclosure policy.

Contact: mailto:{{SECURITY_EMAIL}}
Policy: {{DISCLOSURE_POLICY_URL}}
Encryption: {{PGP_KEY_URL}}
Preferred-Languages: en

10. Incident Response & Reporting

• 24×7 on-call; triage severities; customer notifications per law/contract.
• Root-cause analysis and corrective actions; evidence retention policies.

11. Access Control & Identity

• SSO/MFA support; least-privilege; approvals for elevated access.
• JIT and break-glass procedures; periodic access reviews.

12. Logging, Monitoring & Audit

• Centralized logs with retention controls and alerting thresholds.
• Audit trails for administrative and data access.
• Customer exports: {{LOG_EXPORT_OPTIONS}}.

13. Employee & Physical Security

• Background checks where lawful; mandatory security training cadence.
• Need-to-know access to production data; secure device posture.
• Facilities access controls for applicable locations.

14. Compliance Artifacts & Downloads

15. FAQs

16. Change Log

17. Contact & DPO / Grievance Officer