Platform, Security & Integrations / Compliance

GDPR Compliance

The system supports GDPR (the General Data Protection Regulation — the EU’s data privacy law governing how personal data must be collected, stored, and handled — see Glossary: GDPR). That shapes how we encrypt, store, and access-control call recordings, voicemails, and caller information.

Why does GDPR matter for a phone system specifically?

A phone system handles personal data constantly — caller names, phone numbers, recorded conversations, voicemail transcripts. If your business deals with customers or employees in the EU (or the UK, under similar rules), that data is subject to GDPR’s rules on consent, storage limits, and an individual’s right to have their data deleted.

How do we protect call data under this?

We encrypt calls and call recordings both in transit and at rest (see Call Encryption). We also restrict access to recordings and personal data by role, so only people who genuinely need a caller’s information can get it.

Can you control how long recordings and data are kept?

Yes. Retention periods for call recordings and other stored data are configurable, so you can set them to match your own data-minimization obligations under GDPR rather than keeping everything indefinitely by default.

What if a customer asks us to delete their data?

Because call records, recordings, and voicemails are all identifiable and searchable within the system, specific records tied to an individual can be located and removed to support a deletion or access request.

Does using this system make my whole business GDPR compliant automatically?

No single system makes an entire business compliant — GDPR compliance depends on your overall policies and processes, not just your phone system. What this system provides is the technical foundation (encryption, access control, configurable retention) that supports your compliance program, rather than working against it.