Skip to main content
Audact
See the offer

Security

The documents a security review asks for, before it asks.

Updated 27 August 2026

Eight items: the Article 28 data processing agreement, a sample file showing the machine-readable sub-processor format, how the Article 50 duties are split between Audact and an agency, the EU Data Act switching terms, our certification status, a sample export bundle for a data protection officer, and the DPIA template we do not have.

What a reviewer is checking against

A processor contract covering scope, instructions, confidentiality, security and the sub-processing chain.
Regulation (EU) 2016/679 (GDPR), Art. 28(3)
Technical and organisational measures appropriate to the risk, and a process for testing them.
Regulation (EU) 2016/679, Art. 32(1)(d)
Ongoing integrity of processing systems and of the records they hold.
Regulation (EU) 2016/679, Art. 32(1)(b)
A data protection impact assessment where processing is likely to result in a high risk.
Regulation (EU) 2016/679, Art. 35
Transparency towards a person interacting with an AI system, allocated between provider and deployer.
Regulation (EU) 2024/1689 (AI Act), Art. 50; has applied since 2 August 2026
A maximum notice period for switching cloud service, and the withdrawal of switching charges.
Regulation (EU) 2023/2854 (Data Act), Chapter VI

What is on this page

A compliance receipt per governed interaction, three fields of which anyone can recompute without a key.
Working today
Append-only, hash-chained records: a later change or reordering is detectable by recomputation against a retained commitment.
Implemented
Article 28 DPA, published as a draft.
Counsel review
The sub-processor register, with the country and transfer basis per party, in the Trust Center, plus a sample file showing the machine-readable format.
Register in the Trust Center · sample file downloadable
Coordinated vulnerability disclosure policy with a safe-harbour commitment.
Published
A sample DPO export bundle.
Downloadable
A DPIA template your own data protection officer can adapt.
Not available
ISO 27001, ISO 42001, SOC 2 Type II.
Not certified — no audit engaged

1 · The agreement

Data processing agreement.

The Article 28 agreement covers the processing scope, the sub-processor chain, data residency, the Article 32 security measures, breach notification and crypto-shredding (coming soon) as the erasure mechanism. It is published as a draft under counsel review rather than sent after a call.

The final wording is with external counsel. Where the published text and the countersigned PDF differ after that review, the PDF governs and the change is noted on this page.

2 · The chain

The sub-processor register, and a sample of the file format.

The register that applies is the table in the Trust Center: every sub-processor with the purpose, the data category, the country and the transfer mechanism, including standard contractual clauses where they apply. Customers get 30 days' notice before a party is added, and can object within that window.

The CSV below is not that register. It is a sample showing the machine-readable format a procurement system can ingest, with example DPA reference numbers that have not been checked against the underlying agreements. The sub-processor table in the [Trust Center](/trust) is the authoritative, current register.

3 · Who owes what

Article 50 duties, allocated in the contract.

The reseller agreement allocates the provider-side duties (evidence chain integrity and disclosure attestation) to Audact, and the deployer-side duties (script content, end-client onboarding, collection of opt-ins) to the agency. What it does not yet do is cap anything in money: liability caps will be set in the reseller-agreement template once EU counsel has reviewed it, and until that review is complete neither the Terms of Service nor this page makes a monetary commitment. Ask for the figure at the point where it exists rather than assuming one behind the allocation.

This matters more than it reads. From 9 December 2026, the revised Product Liability Directive treats a party that puts its own name, trade mark or other distinguishing feature on someone else's product as its manufacturer, software included. It is a directive, so it reaches you through the law of your own member state, and which party that is in your setup follows from the role mapping on the white-label page. Section 4 of the Terms of Service says the same thing about the caps, in the same terms.

4 · Leaving

EU Data Act switching and portability.

Chapter VI of Regulation (EU) 2023/2854 has applied since 12 September 2025, so the first and the third term below are rights you hold today; only the ban on switching charges starts later. The third is a right whose delivery was re-measured on 26 August on browser calls, and that is stated here rather than discovered at the exit, because leaving is where a buyer is most often surprised.

  • A two-month exit notice period (phase 1), the maximum under Chapter VI, for customer-initiated switching.
  • No switching charges from 12 January 2027 onward.
  • Export of your evidence chain in a structured, commonly used, machine-readable format. The right follows from Chapter VI and applies whether or not a contract restates it. The delivery was re-measured on 26 August, after the deploy: five calls, thirty validated turns, thirty receipts. That measurement is on browser calls and not over a telephone line, so this line carries the right and the measurement rather than a contractual guarantee.

5 · Certification status

What we hold, and what we do not.

None of the three. That is stated here in the same words as in the Trust Center, because a security team that finds two different answers stops trusting both.

  • Standard
    ISO/IEC 27001
    Status
    Not certified
    What that means here
    No audit is under way. Controls are built against the Annex A control set and we will walk you through them line by line, but no external auditor has assessed them. We publish no target date until an audit is booked.
  • Standard
    ISO/IEC 42001
    Status
    Not certified
    What that means here
    No certification track started. The EU harmonised standards under the AI Act are not final yet, so a management system assessed today would be measured against a moving target. We follow that work and will say so here when a track starts.
  • Standard
    SOC 2 Type II
    Status
    Planned, no auditor engaged
    What that means here
    Sequenced after the first paying deployments so that the audit scope reflects real production controls rather than an empty environment.

6 · The assessment

DPIA template.

There is no DPIA template to download. What this section describes is the intended content, not a document that exists: the Audact data flow, the retention defaults, the lawful-basis options and the risk-mitigation controls for outbound voice AI under GDPR Article 35, written to be adapted by your own data protection officer rather than signed as-is.

7 · The bundle

Sample DPO export.

The JSON bundle a data protection officer receives on request: sample receipts, the policy versions that governed them, consent provenance and the sub-processor matrix at that moment. The sample below is anonymised and carries synthetic values.

8 · Reporting a problem

Coordinated vulnerability disclosure.

Reports go to security@audact.ai, encrypted with our PGP public key if you want to. It is available on request, and the security contact is published at /.well-known/security.txt under RFC 9116. Acknowledgement within 48 hours.

The safe-harbour commitment and the full policy are on their own page, including what counts as acting in good faith and how long we ask for before public disclosure.

Questions

Can we get the DPA as a countersignable PDF?
Yes. The terms are published at /legal/dpa and the PDF is provided during onboarding. Write to privacy@audact.ai if procurement needs it earlier.
Are all sub-processors in the EU?
No. Several are US-incorporated and those transfers run under standard contractual clauses. The Trust Center table gives the country and the transfer mechanism for each party, and that table is the register; the downloadable CSV is a sample of the file format rather than the register itself.
Who is the provider under Article 50, us or Audact?
It depends on the deployment, and the contract says which duties sit where rather than leaving it to be argued later. An agency that puts its own name on a voice agent and sells it on is, in most readings, the provider of that system. Establish it before the first call rather than after.
Do you run penetration tests?
Not yet. No external penetration test has been carried out. A first external test is scheduled before the first paying deployment, and the date is published here as soon as it is booked. Until then we walk the controls through line by line with your security team.
What happens to our data if we leave?
Two months' notice and no switching charges from 12 January 2027. Chapter VI also gives you the right to export your evidence chain in a structured, commonly used, machine-readable format, and that right stands on its own. The production export behind it was re-measured on 26 August on browser calls: five calls, thirty validated turns, thirty receipts, so section 4 states that measurement rather than guaranteeing the delivery. Erasure by destroying the encryption key, which makes the derived ciphertext permanently unreadable, is coming soon.

The wider picture

The Trust Center carries the same facts in the form procurement and legal ask for them: the full sub-processor table, hosting and retention, the entity structure, the marketing claim matrix and the scope of the Audact guarantee.

Trust Center

Related