Security & Trust

Data Protection

Convirza uses encrypted connections (TLS) for its websites, applications and APIs. Call recordings and transcriptions are encrypted in transit and at rest, with access controls limiting visibility to authorized users only.

We run in cloud data centers with physical access controls, redundant power and network, and continuous availability monitoring. We do not operate our own data centers. Hosting details are available on request.

Retention periods are configurable by account. Deletion is applied across production and backup systems under our documented procedures.

Access and Authentication

Access is governed by role-based access controls. Administrators assign permissions per user, so you control what each user can access, export, or modify.

Users sign in with Google, Microsoft or a Convirza login. Any MFA enforced on your Google or Microsoft accounts carries over.

Access and sensitive actions are logged. Audit logs are available to account administrators and to Convirza's security team. Internal access to customer data follows least privilege and is reviewed periodically.

Compliance

Convirza is designed to support HIPAA-compliant workflows. We execute Business Associate Agreements (BAAs) with covered entities and business associates. Email privacy@convirza.com to request a BAA. Healthcare customers, including dental service organizations (DSOs) and home health providers, use Convirza to analyze patient-facing calls.

For EU customers, Convirza supports GDPR obligations as a data processor; you remain the controller. A Data Processing Addendum (DPA) meeting Article 28 requirements is available on request. See our DPA page.

For customers subject to the California Consumer Privacy Act (CCPA), we support your compliance obligations as a service provider. Data Processing Agreement terms covering CCPA are available on request.

We are not currently certified under SOC 2 Type II or ISO 27001. A SOC 2 readiness program is in progress. Customers with specific certification requirements should contact us.

Vendors and Subprocessors

We review vendors for security posture before onboarding and require contractual data-handling commitments where applicable. Our current subprocessors are listed at convirza.com/subprocessors, updated when they change. Customers with a signed DPA are notified of material changes per its terms.

Responsible Disclosure

To report a vulnerability, email security@convirza.com with a description, steps to reproduce and the potential impact. We acknowledge reports within two business days and keep you informed through remediation. Please give us reasonable time to address the issue before disclosing it publicly. We do not operate a formal bug bounty program at this time.