Security
Recordings, Transcripts and Consent, Handled Properly. Adoptiv security: encryption, access controls and calling checks, all published.
A calling platform holds some of the most sensitive material a business has: what customers actually said. Here is how Adoptiv protects it, who can see it, and what we have not certified yet.
- TLS 1.2 or better
- Single sign-on with SAML
- Every policy published
How a call moves through it
- A call connectsAudio carried over TLS 1.2 or better
- Recorded in two channelsEach side of the call on its own
- Kept in your own spaceWalled off from every other customer
- Seen by the right rolesRole tree, sharing rules and single sign-on
- Every change loggedWho changed what, when, and the old value
Where Every Certification Stands, Stated Plainly.
Stated plainly: the SOC 2 audit has not completed, there is no HIPAA business associate agreement, records sit in a single region rather than one you pick, and there is no setting yet that expires recordings or transcripts on a schedule. If any of that has to be in place before you can sign, tell us and we will give you the current timeline rather than a maybe.
How Your Data Is Protected, Control by Control.
What protects your data, who can see it, and the checks that run before a call is made.
Data
Encryption in transit
TLS 1.2 or better on every connection, including the one carrying the audio.
Encryption at rest
AES-256-GCM on the credentials and tokens we store for you. Disks and recording storage use the provider’s own at-rest encryption.
Tenant isolation
Each customer’s records live in their own walled-off space in the database, created with the account.
Separate audio channels
Each side of a call records to its own channel, so a review can tell who said what.
Access
Role hierarchy
Roles inherit down a tree you define, not a flat list.
Single sign-on
SAML, plus Google and Microsoft, configured per tenant.
Sharing rules
Grant cross-team access by rule rather than by exception.
Audit trail
Who changed what, when, and what the value was before.
Calling
DNC screening
Federal and internal registries, checked when the list lands and again before an automated call dials.
Litigator lists
Known-litigator numbers flagged on the record, and a call flow can be set to drop them.
Calling windows
By default, campaigns dial each lead only from 8am to 9pm in its local time, plus its state’s rules.
Abandonment cap
Set per campaign, defaulting to 3%.
The Screening Runs Twice.
A list checked once at import goes stale, because numbers move onto the do-not-call registry between your import and your campaign. So Adoptiv screens the list on the way in, and screens the number again on the automated outbound paths before it dials. Anything arriving the other way can carry the same checks inside its call flow.
How a call moves through it
- Your list landsScreened against federal and internal DNC lists
- It waits for the campaignNumbers can join the registry meanwhile
- Screened againBefore an automated call dials
- On a DNC listNever dialed, with the reason savedClear to callPlaced inside your calling window
Everything a Review Asks for, Already Written Down.
No form, no non-disclosure agreement before you can read a control, and no waiting for a reply. If a question isn’t answered here, write to [email protected] and we will answer it.
If You Connect a Mailbox, Here’s What Happens.
One permission for Gmail
Connecting Gmail or Microsoft 365 gives Adoptiv access to that mailbox. We ask Gmail for one permission rather than several.
Access stored encrypted
The access we are given is stored encrypted, and mailbox access gets its own page rather than a line in a policy.
Disconnecting cleans up
Disconnecting revokes the access with Google and deletes the mail we hold that is not attached to a record.
Security Questions, Answered.
How does Adoptiv protect customer data?
Every connection, including the one carrying call audio, uses TLS 1.2 or better. Credentials and tokens we store for you use AES-256-GCM, disks and recording storage use the provider’s own at-rest encryption, and each customer’s records live in their own walled-off space.
Is Adoptiv SOC 2 certified?
Not yet. The SOC 2 audit is in progress and has not completed. If it has to be in place before you can sign, tell us and we will give you the current timeline rather than a maybe.
Does Adoptiv sign a HIPAA business associate agreement?
No. There is no HIPAA business associate agreement, so a program that needs one is not a fit yet.
Does Adoptiv offer a GDPR data processing addendum?
Yes. The data processing addendum is published, along with the sub-processor list and the data retention schedule, with no form to fill in first.
Who can see our records?
Only the people your setup allows. Roles inherit down a tree you define, sharing rules grant cross-team access, single sign-on works with SAML, Google and Microsoft, and the audit trail shows who changed what and when.
Are call recordings secure?
Call audio travels over TLS 1.2 or better, and recording storage uses the provider’s own at-rest encryption. Each side of a call records to its own channel, so a review can tell who said what.
Can recordings and transcripts expire automatically?
Not yet. There is no setting yet that expires recordings or transcripts on a schedule. The data retention schedule lists what we hold, where it lives and how long we keep it.
Does Adoptiv help with TCPA compliance?
It gives you the tools: DNC screening when a list lands and again before an automated call dials, litigator flags, calling windows in each lead’s local time and an abandonment cap per campaign. The tools help; how you call decides compliance. This is general information, not legal advice.
What happens when a number fails a check?
Each list can block the call, or place it and flag the gap on the contact. A blocked call is never placed, and the attempt is saved on the contact with the check that stopped it, so an audit can see why.
How do I report a security issue?
Follow the vulnerability disclosure policy, which covers what is in scope and how fast we respond, or write to [email protected].
Still have a question? A real person replies in under 60 seconds in US business hours. Talk to our team →
Security review
Bring the Questionnaire. We Will Fill It Out.
Send the spreadsheet your procurement team uses and we will complete it against the pages above, then get on a call with whoever needs to sign off on it.
14-day trial · no card · migration included