Security and data protection

Our commitment

A voice agent listens to real conversations with the people who contact your company. That is why we treat the protection of that data as part of the product, not as an add-on. This page explains, without unnecessary technical jargon, where the data is processed, who is involved and how we protect it.

Your data is processed in the European Union

• Audio, transcripts and conversation content are stored and processed in data centres in the European Union.
• The artificial intelligence models that process your conversations run in the European Union (see “How we use artificial intelligence”).
• Speech recognition and speech synthesis are requested in zero retention mode: the provider does not keep the audio, the text or the output.
• BotStorming Cloud S.L. is a Spanish company and acts as data processor for the data of its customers, who are the data controllers. Your call data belongs to you.

How we use artificial intelligence

Each agent can work with one of these three types of language model. You choose which one.

1. Local model. Open-source models that run only on servers contracted by BotStorming in the European Union. No AI model provider receives your data.
2. Dedicated model in a European cloud. Deployments exclusive to BotStorming, processed entirely in data centres in the European Union. The providers contractually commit not to use the data to train or improve their models.
3. Global model (optional). Some agent configuration features, or global models that you expressly select, may process data outside the European Union. Before you activate this option, the platform warns you that the data may leave Europe. The transfer is covered by the safeguards required by the GDPR.

Your call data is used only to provide the service to you. With your express permission, we may use some of your calls to adjust your agent's configuration. This does not constitute training of the underlying artificial intelligence model: it only affects your agent's configuration. Without your instruction, we do not use your data for any other purpose.

How we protect data

• Encryption. Data is encrypted at rest and in transit.
• Access control. Individual access and multi-factor authentication for administration, with the minimum permissions necessary.
• Isolation. Each customer's data is kept separate.
• Private network. Internal systems are only accessible through an encrypted private network.
• Continuous monitoring. Permanent monitoring, activity logging and detection of intrusions and malware.
• Backups and continuity. Encrypted backups and a redundant architecture for critical components.
• Incident response. A documented procedure for detection, response and notification. Should a security breach affecting your data occur, we will notify you without undue delay.
• People. All staff with access to the data are bound by confidentiality.

Regulatory framework

• We comply with the General Data Protection Regulation (GDPR) and Organic Law 3/2018.
• We are aligning our security management system with the Esquema Nacional de Seguridad (Spanish National Security Framework, High category) and with ISO/IEC 27001.
• We choose providers and sub-processors with the appropriate certifications for each case.
• We provide information on transparency in the use of artificial intelligence in accordance with Regulation (EU) 2024/1689, and we make available to you the means for your agent to inform people that they are interacting with an AI and that the call is processed and, where applicable, recorded.

Providers (sub-processors)

We work with a small number of providers. The full list, with the service each one provides and the location of the data, is on the Sub-processors page.

Data processing agreement (DPA)

All our customers have a data processing agreement in accordance with Article 28 of the GDPR. You can request it at contact@botstorming.com.

Retention and deletion

You decide how long your call data is kept. You can export and delete your data by section from the platform and, when the service ends, we return or delete it, as you choose.

Contact

For any question about security or data protection: contact@botstorming.com.