Data Security

1. Our Security Commitment

We apply industry-recognized security practices across every stage of our service delivery—from initial consultation through solution deployment and ongoing support. Our approach to data security is guided by the principles of data minimization, least-privilege access, encryption, and continuous monitoring.

2. Encryption

2.1 Data in Transit

All data transmitted between your systems, our platforms, and third-party tools is protected using TLS 1.2 or higher encryption. This includes website traffic, API connections, webhook communications, and data flowing through our automation workflows built on n8n and other platforms.

2.2 Data at Rest

Data stored on our behalf by our technology partners (including CRM platforms, cloud storage, and AI service providers) is encrypted using industry-standard protocols such as AES-256. We require that all third-party providers we work with maintain equivalent encryption standards.

3. Access Controls

• Role-Based Access: Access to client data and systems is restricted on a role-based, need-to-know basis. Only authorized team members who are directly involved in building, deploying, or maintaining your solutions have access to your data.
• Authentication: We use strong authentication methods, including multi-factor authentication (MFA), for all administrative access to our internal tools and client systems.
• Third-Party Access: We carefully vet all third-party platforms and partners. Access credentials for your business tools (CRMs, payment processors, communication platforms) are stored securely and never shared outside of the required integration context.

4. AI-Specific Security Measures

Because our solutions use AI technologies, we implement additional safeguards:

• Prompt Injection Protection: Our AI chatbots and voice agents are configured with guardrails to prevent manipulation through prompt injection or other adversarial techniques.
• Output Monitoring: We monitor AI outputs for accuracy and appropriateness, with escalation paths to human team members when the AI encounters edge cases.
• Data Minimization in AI Processing: We configure AI tools to process only the minimum data necessary for their function. For example, a voice agent handling appointment booking does not need access to your full customer database—it only receives the data required to complete the booking.
• Model and Platform Selection: We use established, enterprise-grade AI platforms (such as Retell AI and Relevance AI) that maintain their own security certifications and data protection practices.

5. Infrastructure and Hosting

Our automation workflows and integrations are hosted on reputable cloud infrastructure with:

• Secure Cloud Providers: We utilize cloud platforms that maintain SOC 2, ISO 27001, or equivalent security certifications.
• Network Security: Firewalls, intrusion detection, and regular security monitoring are standard across our infrastructure.
• Regular Updates: We keep all platforms, tools, and dependencies up to date with the latest security patches.

6. Vendor and Third-Party Risk Management

We work with trusted third-party platforms to deliver our services. We evaluate each vendor's security posture before integrating them into our solutions. Key vendors include:

We require data processing agreements (DPAs) from all vendors that handle personal data on our behalf, ensuring contractual commitments to confidentiality, security, and compliance.

7. Incident Response

In the unlikely event of a data breach or security incident, we follow a structured incident response process:

• Detection and Containment: We immediately identify and contain the incident to prevent further exposure.
• Assessment: We evaluate the scope, cause, and impact of the incident.
• Notification: We notify affected clients and, where required by law, the Texas Attorney General and other relevant authorities within the timeframes mandated by the TDPSA and other applicable regulations.
• Remediation: We take corrective actions to address vulnerabilities and prevent recurrence.
• Documentation: We maintain detailed records of all incidents and our response actions.

8. Data Backup and Recovery

We maintain regular backups of critical data and configurations. Backups are encrypted and stored in geographically separate locations from primary systems. We regularly test our recovery procedures to ensure we can restore services quickly in the event of a disruption.

9. Employee and Contractor Security

• Background and Vetting: All team members and contractors who have access to client data are vetted and required to agree to confidentiality obligations.
• Training: Our team receives regular training on data security best practices, recognizing phishing attempts, and handling sensitive information.
• Least Privilege: Team members are granted only the minimum level of access necessary for their specific role and tasks.

10. Compliance Alignment

Our security practices are designed to align with the following frameworks and regulations:

• Texas Data Privacy and Security Act (TDPSA): We comply with controller and processor obligations under the TDPSA, including data minimization, purpose limitation, consumer rights, and security requirements.
• Texas Responsible AI Governance Act (TRAIGA): Effective January 1, 2026, we comply with TRAIGA's requirements for responsible AI deployment, including prohibitions on manipulative, discriminatory, or harmful use of AI systems.
• NIST AI Risk Management Framework: We use the NIST AI RMF as a reference point for our AI governance practices, including risk identification, testing, and monitoring.
• SOC 2 Principles: While we may not yet hold a formal SOC 2 certification, our practices are designed to align with SOC 2 trust service criteria for security, availability, and confidentiality.

11. Your Role in Security

Data security is a shared responsibility. We encourage our clients to:

• Use Strong Passwords: Secure all accounts and platforms connected to our solutions with strong, unique passwords and enable MFA where available.
• Review Access Regularly: Periodically review who in your organization has access to the tools and systems we configure.
• Report Suspicious Activity: Notify us immediately if you notice any unusual or unauthorized activity on platforms connected to our services.
• Keep Your Systems Updated: Ensure your own devices, browsers, and software are kept up to date with security patches.

12. Questions About Our Security Practices

If you have questions about how we protect your data or would like to request more detail about our security controls, please contact us: