Skip to main content
Audact
See the offer

Procurement checklist

Ten questions your DPO will ask.

General information about Audact, not legal advice

These are the questions a Data Protection Officer or a procurement team raises before a voice AI vendor is approved. Each one carries our answer and the page where you can check it yourself, because an answer you cannot verify is worth about as much as no answer.

The checklist

Ten questions, ten answers, ten places to check them.

Print this, take it into the review, and hold every vendor to the same list. If an answer here turns out to be wrong on the page it points to, that is a defect and we would like to hear about it.

  • Question
    Where is our data hosted?
    Our answer
    Primary application hosting is Frankfurt (eu-central-1), physically in the EU. The provider is incorporated in the United States; a move to an EU-owned provider is under evaluation and no date is set. We state that exposure to non-EU legal process openly rather than describing the setup as EU-only.
    Check it
    Trust Center
  • Question
    Who are your sub-processors, and is the list current?
    Our answer
    The full list is published (provider, country, function and data category), and customers are notified 30 days before a new one is added. Every transfer outside the EEA runs under standard contractual clauses. If the list is stale, that is a defect: it carries the date it was last reviewed.
    Check it
    Sub-processor list
  • Question
    Is a data processing agreement available before signature?
    Our answer
    Yes, and it is readable on the site rather than sent after a contract is agreed. It covers scope of processing, sub-processors, security measures, audit rights and breach notification, aligned to Article 28 GDPR.
    Check it
    Read the agreement
  • Question
    What are the retention periods, and is the deployment in our record of processing?
    Our answer
    Call audio is not retained by default; where the customer switches recording on it is kept for up to 90 days and then deleted. Receipt metadata is kept for the term of the agreement and afterwards only for as long as a rule that applies to the customer requires. The record of processing activities is published, so you can lift the relevant rows straight into your own Article 30 register.
    Check it
    Record of processing
  • Question
    How are data-subject and deletion requests handled?
    Our answer
    As processor, we assist with access, portability and erasure requests, and the route for each is published rather than negotiated per case. Erasure will destroy the key that decrypts the payload (coming soon), so the sequence remains checkable while the content is gone.
    Check it
    Deletion route
  • Question
    Is the Article 50 disclosure made, and is there evidence of it?
    Our answer
    The disclosure is played inside the call flow at the position the policy for that country requires (Germany active · Netherlands in progress · Belgium, Austria queued). The evidence record for the call holds the approved disclosure text, its language, and the moment its audio finished being sent. It does not record that the caller heard or understood it. A sample receipt in the production format is available for download: the fields the engine issues, with synthetic values. The input and output texts are included beside the receipt so the hashes can be recomputed; a production receipt carries only the hashes. Status: In controlled testing.
    Check it
    Open the receipt explorer
  • Question
    What happens when there is a breach?
    Our answer
    We notify you without undue delay after becoming aware of a personal-data breach. The Article 33(1) deadline towards the supervisory authority stays with you as controller. Security findings go to security@audact.ai under a responsible-disclosure policy, including findings from people who are not customers.
    Check it
    Security
  • Question
    How is data encrypted and access controlled?
    Our answer
    TLS 1.3 in transit, AES-256 at rest; crypto-shredding for erasure is coming soon. Access is role-based, multi-factor authentication is mandatory for administrative access, and the access log is retained.
    Check it
    Security
  • Question
    What certifications do you hold?
    Our answer
    We are not certified. Audact holds no ISO 27001, no ISO 42001, and no SOC 2 report of either Type I or Type II, and no certification audit is scheduled. The control documentation is mapped to those standards as a starting point.
    Check it
    Trust Center
  • Question
    Can we get all of it in one place?
    Our answer
    Yes. The Trust Center holds the processing agreement, the sub-processor list, the Article 50 templates, the record of processing and the security summary, so the procurement file can be assembled without a round of email.
    Check it
    Trust Center

The one-minute check

Hand your DPO the artefact instead of the assurance.

The receipt is what a reviewer actually inspects, so it is downloadable without a form. It is an illustrative teaching format with synthetic values; the mapping to the production receipt is on /proof.

Three of its fields can be recomputed by anyone today, without a key and without an account: the input hash, the output hash, and the link to the previous receipt. A fourth, its inclusion in the Merkle root, is checked against the published root with the inclusion proof from the call's Article 50 report. The authentication code is different: it is an HMAC-SHA256 under a symmetric key held by Audact, which detects alteration or reordering for whoever holds that key.

Everything procurement needs, in one place

The Trust Center collects the processing agreement, the sub-processor list, the Article 50 templates, the record of processing activities and the security summary. That is the file most procurement teams ask for, assembled once rather than per request.

View current product status

Related