What procurement, security and legal can assess today.

At a glance

Each line with the kind of status that fits it.

Every line below is either a document on this page, a link, or a statement we will repeat in writing on request. The status word follows the kind of thing it describes, because one word cannot carry six kinds of fact: a company is verified in a public registry, a technical control is implemented, a contract is in draft, under counsel review or contractual, a template is available or it is not, a product is in controlled testing, and a certification is held or it is not.

Dylan, quality assurance, tests the compliance checks against live calls and records, per check, what it actually does. The measurements behind the product status on this site are his.

Sub-processors

Every party that touches the data, with the country it sits in.

We notify customers 30 days before adding a new sub-processor. Several of the parties below are US-incorporated; those transfers run under standard contractual clauses.

Certification status

What we hold, and what we do not.

Audact holds no security or AI management certification.

EU AI Pact

Signatory to the voluntary Pillar II commitments.

Audact AI Ltd is a signatory to the European Commission's AI Pact and submitted its Pillar II voluntary commitments on 10 June 2026. The company appears on the Commission's public signatory register, which means a third party can check this without asking us. That is why it is here.

The Commission states that the pledges are not legally binding and impose no legal obligations on participants. Signing is therefore not a certification, not an audit and not a regulatory approval; it does not make a system conform to the AI Act and creates no legal presumption that it does.

Records of processing

Article 30 summary.

A public summary of the record of processing activities. A per-customer record does not exist yet; the first one is drawn up with the first paying deployment.

• Processing categories: voice AI agent calls inbound and outbound, evidence chain attestation, brand governance validation, billing.
• Data subjects: the end clients and callers of Audact's agency customers.
• Retention: call audio is not retained by default; where the customer switches recording on it is kept for up to 90 days. Evidence-chain records are kept for the term of the agreement and thereafter only as long as the customer’s applicable rule requires.
• Lawful basis: performance of the contract (Art. 6(1)(b)) for the Audact-to-agency relationship. The agency is responsible for the lawful basis towards the end caller.

Security summary

The controls, described rather than certified.

Marketing claim matrix

What an agency, and Audact, may say in public.

Intellectual property and entities

Who holds what.

• Patent-pending governance stack, filed at the UK Intellectual Property Office by Audact AI Ltd. All filings are filed applications; none is granted, none has been searched or examined, and nothing here should be read as a blocking claim against any company.
• Audact AI Ltd — UK Companies House number 17059133 — is the IP-holding entity.
• AUDACT AI LIMITED — Ireland, CRO 822514 — is the operating company. Which Audact company is party to your contract is set in the order form you sign; the DPA, section 1, states the position.
• Which of the two is party to a given contract is named on the signed order form. An agreement signed with the UK company is assigned to the Irish company by written notice, effective on the date of that notice. This page does not assert that every existing agreement has already been assigned. Ask legal@audact.ai for the position on your own contract before you sign.
• Detailed IP documentation is available to customers and counsel on request.

Where the stack is going

EU-native sourcing, layer by layer.

Some current sub-processors are US-incorporated but physically EU-hosted. The table says where each layer stands and what is being evaluated. We publish no target date until a move is contracted.

The Audact guarantee

A narrow guarantee, and its edges.

If the governed engine should have stopped an utterance under the active rules and did not, you get the evidence file to answer with, and any financial compensation your signed order form provides. It is deliberately narrow, and the second list is the part worth reading twice.

• Covered: misses by the Audact governance engine — cases where the engine should have blocked an utterance under the active rules and did not.
• Not covered: prompt engineering by the customer that works around the intent of a policy.
• Not covered: misuse by the end client, including switching compliance rules off.
• Not covered: obligations outside the jurisdictions that are configured.
• Not covered: deployments that required a fundamental rights impact assessment where the customer did not complete one.
• Not covered: regulatory changes after deployment. We update the rule set; the obligation to migrate stays with the customer.

Status and contact

How to reach a person, and what is not running yet.

A public status page with uptime metrics and incident history is in development. Until it exists, service status is communicated to customers directly.

The production export of a set of receipts worked when it was retested on 26 August 2026 after the deploy: five calls, thirty validated turns, thirty receipts, across two agents and two configurations, measured on browser calls rather than over a telephone line.

• security@audact.ai: security disclosures and the coordinated disclosure policy.
• privacy@audact.ai: data subject requests and GDPR matters.
• legal@audact.ai: contractual questions, and requests for the DPA as a PDF.
• regulators@audact.ai: supervisory authorities, data protection officers and counsel.