How Intract protects your customer conversations: where the data lives, what our AI does with it, and the controls in place today. Every statement here is backed by our code or configuration. What is not in place yet is marked as such.
We act as a processor under a data processing agreement (DPA) with our customers. Data subject requests and end-of-contract deletion are handled by our team with documented procedures. Our record of processing and DPIA are being prepared.
Intract is not ISO 27001 certified. Certification is planned. The controls in place today are listed on this site.
For customers in financial services: an information pack to support your DORA obligations is planned.
What happens to your calls once they reach Intract.
All language-model processing (analysis, workflows, translation, assistant) runs on Azure AI Foundry, in Intract's own Azure tenant. No other AI provider receives your data.
The Azure AI Foundry resource is in Sweden, and models are deployed with Azure's EU Data Zone deployment type: requests are processed only within the European Union.
Every request to the models is sent with response storage turned off, so prompts and responses are not saved for later retrieval.
Intract does not train or fine-tune models on your data. Microsoft's terms for Azure OpenAI state that prompts and completions are not used to train its models.
Microsoft: data, privacy and security for Azure OpenAICalls are transcribed (words, speakers, language). We do not analyse the voice itself: no acoustic analysis, no emotion recognition from the voice. Tone and urgency are inferred by a language model from the transcript text.
Each issue raised by a customer comes with the customer's exact words from the transcript, shown next to it. Summaries, sentiment and action plans are generated by the model without citations.
Transcripts are timestamped: clicking a line plays that moment of the recording.
No storage link to a recording ever reaches the browser. Audio is streamed through our server after an access check, and every listen is logged.
Speech-to-text runs on AssemblyAI's EU endpoint. After each transcription, Intract asks AssemblyAI to delete its copy of the transcript.
In the EU. The database is in Paris, audio and files in Western Europe with a redundant copy in a second European region, and AI processing runs in Azure's EU Data Zone.
No. Intract does not train or fine-tune models on your data, and Microsoft's terms for Azure OpenAI state that prompts and completions are not used to train its models. Requests are also sent with response storage turned off.
In the application, only users of your company with access to the team concerned, and every listen is logged. There is no support or impersonation feature that would let Intract staff use your workspace.
As long as you decide. You set a retention period for your company, with exceptions per team, and a daily job deletes audio files after that period. By default, audio is kept until you set one. Audio from Aircall or Vonage stays with your telephony provider and is not copied to Intract.
Tickets and end customers can be deleted in the application, and admins can remove members. At the end of the contract, our team deletes all of your company's data and sends you a dated report. Data subject requests (access, deletion) are handled by our team on request.
We follow a written incident response plan, which covers severity levels, response times and the decision to notify the supervisory authority within 72 hours where the GDPR requires it.
The full list, with purpose, data and region, is on the Sub-processors page.
No. Certification is planned. The controls in place today are listed on the Controls page.
No. We transcribe calls and work on the text only. Tone and urgency are inferred by a language model from the transcript, not from the voice.
SSO with SAML and Microsoft Entra ID is being rolled out. Contact us to get it at launch.
Found a security issue? Write to us. Please do not disclose it publicly before we have fixed it.