Security & Compliance

HIPAA Compliant PCI-DSS Compliant SOC 2 (In Progress) PII/PHI Auto-Masking Encryption In Transit Encryption At Rest

Data handling

What happens to your data.

No call recordings stored

OttoQA does not store call recordings or raw transcripts on our servers. We process the audio, generate the evaluation, and the source material is not retained.

Automatic PII/PHI masking

All personally identifiable information is automatically detected and redacted before storage. Names, Social Security numbers, account numbers, dates of birth, credit card numbers, medical information. Masked in evaluations, masked in reports, masked in coaching data.

Encryption everywhere

All data is encrypted in transit (TLS 1.2+) and at rest (AES-256). API communications use HTTPS exclusively. There is no unencrypted path to your data.

Access controls

Role-based access ensures team members only see the data relevant to their role. Supervisors see their team. Managers see their department. Nobody sees what they shouldn't.

Compliance

Built for regulated industries.

HIPAA compliance

OttoQA is designed to meet HIPAA requirements for healthcare contact centers. PHI is automatically identified and masked. Our data handling practices align with the Privacy Rule and Security Rule requirements for business associates.

PCI-DSS compliance

For financial services and any contact center handling payment card data, OttoQA meets PCI-DSS requirements. Credit card numbers, CVVs, and account numbers are automatically masked and never stored in evaluations.

FDCPA and collections compliance

For debt collection agencies, OttoQA scores every call for FDCPA compliance including Mini-Miranda delivery, third-party disclosure rules, and harassment indicators. Compliance documentation is maintained for regulatory audits.

Infrastructure

Where your data lives.

Cloud infrastructure

OttoQA runs on enterprise-grade cloud infrastructure with 99.9% uptime SLA. All servers are located in the United States.

Regular security reviews

We conduct regular security assessments and code reviews. Our infrastructure is monitored 24/7 for anomalies and potential threats.

Business continuity

Automated backups, disaster recovery procedures, and redundant systems ensure your QA data is protected and available when you need it.

Questions?

Need more detail for your security review?

We're happy to complete your vendor security questionnaire, provide additional documentation, or get on a call with your compliance team.

[email protected]

Your data is safe. Here's how.