Rules and compliance2 min read
Security questions worth asking
You are about to send every conversation with every customer through somebody else's system. It is worth ten minutes of questions.
Published 27 May 2026 · Updated 15 August 2026
Routing your calls to a supplier means handing over recordings, transcripts and whatever your customers happen to say, which in some sectors includes health information and financial details.
Most providers handle this properly. The point of asking is to find the ones who do not, and the questions take longer to avoid than to answer.
The core questions
Ask these in writing. A supplier who will not put answers in writing has told you something useful.
- Where are recordings and transcripts stored, and in which country?
- Is data used to train models, and can we opt out?
- What is the default retention period, and can we set our own?
- Who inside your organisation can access our call data?
- Is data encrypted in transit and at rest?
- What happens to our data when we leave?
- Have you had a security incident, and what was the outcome?
- Will you sign a data processing agreement?
The training question matters most
Whether your customers' conversations are used to improve a supplier's models is the question with the least standard answer across this market.
For most businesses the acceptable answer is no, or yes with an opt out you have taken. For anybody handling health, legal or financial information it should be no.
Easier to hear than to read about
Callwise answers your phone the way this article describes. Ring it, ask it something awkward, and see whether it holds up.
Talk to our AI assistantData residency
UK or EEA storage keeps the analysis simple. Transfers elsewhere are lawful with the right safeguards, but they add complexity you have to document and justify.
Ask specifically about sub processors, because the answer for the main platform is often different from the answer for the underlying model provider.
Exit
Ask how you export your data and how quickly it is deleted after termination. This is the question suppliers are least prepared for and the one that matters most on the day you need it.
Get the retention on termination in writing before you sign anything.
Proportionality
A sole trader booking window cleaning does not need the same assurance as a dental group handling patient data. Ask questions proportionate to what your calls actually contain.
But do ask. The uncomfortable discovery usually happens after a customer asks you where their recording went.
Questions people ask
Is a data processing agreement really necessary?
If a supplier processes personal data on your behalf, yes. It is a standard document and any established provider will have one ready.
What about payment details?
Avoid taking card numbers by voice altogether. Sending a payment link after the call keeps card data out of your recordings and out of scope.
Read next
Recording calls under UK GDPR
Recording business calls is lawful and routine. Doing it without telling anyone, or keeping the recordings forever, is where businesses get into difficulty.
Is it legal to use an AI receptionist?
Answering your own inbound calls with software is lawful. The rules that matter are about data and transparency, not about automation itself.
How to choose an AI receptionist
Almost every product in this category demos well on a scripted call. The differences show up on the calls nobody scripted.
Hear it answer a call
Ring the assistant and ask it the awkward question your customers always ask. If you like what you hear, it will book you in there and then.
Talk to our AI assistantNo form, no sales call. Thirty seconds on the phone with the thing itself.