01How we protect your data

These are the measures we apply to your data. The same list is Annex II of our Data Processing Addendum. We may change them over time. No system is completely secure, and we do not guarantee that the Services or your data will be free from unauthorized access, interruption or loss; our liability is limited as our Terms of Service provide.

Area	Measure
Encryption in transit	Our website and application are served only over HTTPS, and connections to our database require TLS.
Encryption at rest	Our database is encrypted at rest. Two-factor login secrets are also encrypted with AES-256-GCM.
Backups	Our database is backed up daily.
Passwords	Passwords are stored only as bcrypt hashes.
Separation of customers	Each customer’s contacts and calls are kept in their own database schema, and every other record is tied to its account so the application shows it only to that account.
Staff access	Staff accounts require two-factor login. Staff access to a customer’s data through our admin tools is logged, and administrative actions are recorded in an audit log.
Customer access	Customer admins can require two-factor login for their users. Representatives see only their own calls; managers and admins see all calls in their account.
Sign-in protection	Bot protection on sign-up and password sign-in, rate limiting, and protection against cross-site request forgery.
Testing	We run penetration tests regularly.
Customer verification	Accounts set up in the application pass identity, business and sanctions checks before they can dial.
Abuse controls	Calls to 911 are blocked. Contacts marked “do not call” or “wrong number” are excluded from automatic dialing. Calling hours and state rules are available, and we apply limits on lines and call volume.
Personnel	Everyone with access to customer data is bound by confidentiality.
Vulnerability reports	Report security issues to contact@personnect.ai.

02Certifications and compliance

We do not hold a SOC 2 report or any other third-party security certification.
Calling laws: Personnect gives you tools that help you follow the TCPA and state calling rules, such as do-not-call suppression, calling hours and state rules. You stay responsible for how you call; see our Terms of Service.
Privacy: how we handle personal information, and how to make a privacy request, is in our Privacy Policy.

03Call recordings

Call recording is on unless you switch it off in your compliance settings.
Recordings are kept by our voice carrier for one year and then deleted.
In the application, representatives see only their own calls; managers and admins see all calls in their account.

04Data retention and deletion

Managers and admins can export your contacts, and each user can export the conversations they can see.
For 30 days after your account closes, we send you an export of your contacts and call history on request.
We keep your data after your account closes. You can ask us to delete it by writing to contact@personnect.ai; we review each request under the law that applies.
How long we keep each kind of data is in Section 13 of our Privacy Policy.

05Responsible disclosure

If you discover a security vulnerability in Personnect, please report it to contact@personnect.ai with details. We review the reports we receive.

06Contact

contact@personnect.ai
Personnect.ai LLC
8893 Cobblestone Point Circle
Boynton Beach, FL 33472