Listen by Abilitix

Listen by Abilitix

Security, privacy & compliance

We design Listen to protect operational call data. Abilitix runs a shared assurance programme: an ISO 27001–aligned information security management system (ISMS) readiness track for Australian and enterprise procurement, and SOC 2 Type II–aligned controls for buyers who map to Trust Services Criteria. ISO 27001 certification and SOC 2 Type II attestation are on our roadmap — we do not hold them yet and do not claim certifications we have not earned. Since 2026 we have run a structured readiness programme with internal control mapping, periodic evidence packs, and gap closure with strict tenant isolation. Evidence is available for vendor review under NDA.

1. ISO 27001 & SOC 2 readiness

Since 2026, Abilitix has run one structured readiness programme that supports both frameworks — the same engineering controls and periodic evidence packs:

  • ISO 27001–aligned ISMS — policies, risk register, scope and Statement of Applicability (SoA) artefacts, and management review as part of evidence collection (primary framing for ANZ enterprise and BPO procurement)
  • SOC 2–aligned controls — mapping to Trust Services Criteria (Security, Availability, Confidentiality) for buyers who use SOC language
  • Internal control reviews — assessments of tenant isolation, audit logging, access control, and data-handling practices
  • Engineering gates — tenant isolation enforced by design and verified by automated cross-tenant isolation tests in CI; security controls documented in our engineering baseline
  • Gap closure — partial controls tracked and remediated before a formal certification or observation window

Formal certification and Type II attestation each require an external auditor and defined observation period — separate steps from readiness. We do not publish a target certification date. Procurement teams can request our current evidence summary under NDA: security@abilitix.com.au

2. Audio minimisation

Default: raw audio is deleted from Abilitix storage after scoring. Listen is not a recording archive — keep master recordings in your own systems. Audio is sent over TLS to Deepgram’s Australia API endpoint for transcription; transcript text for scoring is sent to US-based AI partners (see §4).

Optional: a tenant admin may opt in to retain audio for in-product QA listen-back. Retained audio follows the same content retention window as call records and is purged with them. Production opt-in should be covered in the customer DPA/schedule.

  • Deepgram model-improvement opt-out enforced in code on batch STT and Coach Practice Voice Agent Settings (mip_opt_out); executed data processing agreement with Deepgram
  • Transcripts and QA results retained per tenant policy (typically 30–180 days, configurable)
  • All API and subprocessor traffic uses TLS

3. Tenant isolation & audit trail

  • Supabase Row-Level Security (RLS) — database queries are tenant-scoped; one customer cannot access another's jobs, transcripts, or scores through the platform
  • Role-based access control (RBAC) — Admin, QA Manager, and Analyst roles; mutating settings, rubrics, alerts, and user management gated in the API and UI
  • Application enforcement — API access binds to authenticated tenant identity
  • Append-only audit events for state changes on jobs, scores, and tenant operations
  • Tenant isolation enforced by design (JWT-scoped access and row-level security) and verified by automated cross-tenant isolation tests in CI

4. Data residency & subprocessors

At rest: transcripts, scores, and tenant metadata are stored in Sydney (AWS ap-southeast-2) on Supabase. API and background workers run on Fly.io in Sydney.

Cross-border processing: Audio is transcribed via Deepgram’s Australia API endpoint (api.au.deepgram.com). Transcript text is sent to Anthropic (United States) for scoring, sentiment, and summaries, and to optional services below when enabled. Optional Coach Practice live voice (when enabled for your tenant): agent audio for listen and speak uses Deepgram’s Australia endpoint; the customer persona think step is processed outside Australia via Deepgram’s managed LLM provider — not the same residency as batch transcription. Post-session practice scorecards use the standard batch pipeline (AU transcribe → US scoring). Content is sent over TLS for processing — it is not stored at rest on those platforms by Abilitix beyond the processing workflow. This is disclosed for APP 8 transparency; see our Privacy Policy.

For procurement (APP 8)

At rest: Sydney (ap-southeast-2). Transcription: Deepgram Australia API endpoint over TLS — mip_opt_out; executed processor DPA with Deepgram. Scoring: Anthropic (US) over TLS — no training on your data. Coach live voice (optional): listen/speak AU; think cross-border — not fully onshore. Audio: deleted after scoring by default; tenant may opt in to retain for QA listen-back (bound to content retention). Customer DPA and evidence pack: security@abilitix.com.au. Listen is designed as an assurance layer on exported or ingested recordings — it does not require replacing your contact centre, training, or analytics stack.

No call content: our static website on Vercel does not receive or store audio, transcripts, or scores. Stripe receives billing contact and payment tokens only.

Subprocessor list with data location and safeguards
Layer Partner Purpose Data location & sovereignty Safeguards
Database & authSupabase (AWS)Multi-tenant DB, auth, private storageAustralia (Sydney, ap-southeast-2)At rest: tenant content onshore. RLS + JWT-scoped access.
ComputeFly.ioAPI & worker pipelineAustralia (Sydney)Compute onshore; cross-border calls to AI partners below.
FrontendVercelStatic UI hostingGlobal edge (vendor-managed)Zero customer call data — static assets only; API calls go to Fly.io.
Speech-to-textDeepgramTranscription (audio)Australia (api.au.deepgram.com)TLS in transit; mip_opt_out on every request; Abilitix deletes audio after scoring by default (tenant opt-in retain for QA listen-back).
Live voice practice (optional)Deepgram Voice Agent; OpenAI (think via Deepgram)Coach Practice live roleplay — agent mic audio & customer persona dialogueSplit: listen + speak → Australia; think → outside Australia (managed provider)Only when Coach Practice live voice is enabled. mip_opt_out on Voice Agent Settings; server-side WSS proxy (API key not in browser). Abilitix does not persist live dialogue in the database. Post-session score uses batch STT + Anthropic scoring above.
Scoring LLMAnthropicScoring, sentiment, summaries (text only)United StatesCross-border transit; commercial API terms — not used to train public foundation models; vendors may retain briefly for abuse monitoring per their published policy (not Abilitix model training).
Embeddings (optional)Google GeminiCall Intelligence vectorsUnited StatesOnly when Call Intelligence enabled.
Knowledge (optional)Ask AbilitixKnowledge Accuracy policy lookupPer deployment URLOnly when Knowledge Accuracy enabled; query text only (no audio).
PaymentsStripeBilling & subscriptionsUnited States (vendor-managed)Billing scope only — no calls or transcripts.

Subprocessor evolution notice

To maintain security and performance, Abilitix may modify or replace subprocessors (for example regional AI endpoints when verified). Material changes will be reflected on this page and communicated in accordance with our Privacy Policy and customer agreements. We target at least 14 days’ notice where practicable for structural processing changes; enterprise contracts may specify longer periods. Enterprise customers may request subprocessor update notifications via security@abilitix.com.au.

5. Audio retention vs transcript retention

Two separate clocks. Raw audio — deleted after scoring by default; optional tenant opt-in retains audio for in-product QA listen-back until the job is purged under content retention. Transcripts and scores — tenant content retention (typically 30–180 days from job completion).

Prefer masters in your own systems. Production opt-in should be covered in your DPA/schedule — security@abilitix.com.au.

6. No training on your data

We do not use customer calls, transcripts, or scores to train Abilitix models. AI subprocessors are engaged under commercial API terms so content is not used to train public foundation models; vendors may retain data briefly for abuse monitoring or security per their published policies — that is not Abilitix training. Abilitix maintains executed data processing agreements with key processors (including Deepgram). See also our Terms of Service §7 and the subprocessor table in §4 above.

7. Australian privacy

We handle personal information in accordance with the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs), including APP 8 overseas disclosures where transcript or metadata is processed by subprocessors listed above.

Full details: Privacy Policy.

8. Vendor review pack

For IT and procurement assessments we can share our security overview and internal evidence pack under NDA — including ISO 27001–aligned ISMS artefacts, SOC 2–aligned control mapping, subprocessor disclosures, and Data Processing Agreement (DPA) terms — typically within a few business days of request.

security@abilitix.com.au · privacy@abilitix.com.au

arrow_back Back to Listen (Trust & FAQ)