Security

Your transcripts stay yours.

Sermo listens to some of the most sensitive conversations your company has. Here is exactly where that audio goes, who can reach it and how quickly you can take it back.

Compliance

Audited, not asserted.

Reports and questionnaires are available under NDA. Ask and you will have them the same week.

SOC 2 Type II

Audited every year by an independent firm, covering security, availability and confidentiality.

SOC 2 Type II

Audited every year by an independent firm, covering security, availability and confidentiality.

ISO 27001

Certified information security management across the platform, not just the parts customers see.

ISO 27001

Certified information security management across the platform, not just the parts customers see.

GDPR ready

Standard contractual clauses, a signed DPA and EU residency available on every plan.

GDPR ready

Standard contractual clauses, a signed DPA and EU residency available on every plan.

HIPAA on request

A BAA is available for regulated workspaces, with retention and redaction configured to match.

HIPAA on request

A BAA is available for regulated workspaces, with retention and redaction configured to match.

How it works

Three things we will not compromise on.

Everything below is on by default. None of it is an upgrade or an enterprise add-on.

Encrypted the whole way

TLS 1.3 in transit and AES-256 at rest. Bring your own KMS key, rotate it on your schedule, and revoking it locks the workspace within a minute.

Access on a need to know

Role-based permissions, SSO and SCIM on every plan. Every internal lookup is logged, attributed and available to you in an export.

Residency you choose

Pin a workspace to the EU, US or APAC. Audio, transcripts and derived models never leave the region you picked.

Never shared training data

Your conversations train your agent and nothing else. They are not pooled, not used to improve a shared model, and not sent to a third party for labelling.

Per-workspace isolation, always on

Retention you set, down to seven days

Hard delete within 24 hours of request

Ridgeline workspace

Encrypted

Card ending

refunded

Sent to

at

Never used for shared training

Subprocessors

Everyone who touches your data.

We give thirty days notice before adding anyone to this list, so nothing arrives as a surprise.

Provider

Provider

Purpose

Location

Location

Amazon Web Services

Cloud infrastructure, compute and encrypted storage

United States, Ireland

Cloudflare

Content delivery, DDoS protection and WAF

Global edge network

Datadog

Application monitoring, logging and alerting

United States

Google Cloud

Speech recognition and model inference

United States, Belgium

Postmark

Transactional and notification email

United States

Stripe

Subscription billing and payment processing

United States

Get started

Ready to hear what your support could sound like?

We will build you a working agent on your own transcripts and show you the numbers before you commit to anything.

Refund issued · 0:38

Refund issued · 0:38

Escalated to Priya

Escalated to Priya

CSAT 5.0 · voice

CSAT 5.0 · voice

Create a free website with Framer, the website builder loved by startups, designers and agencies.