Trust Center
Security and compliance you can verify
Access CloudTalk’s security documentation, certifications, and compliance reports, kept up to date and available on request.
Certifications & compliance
Documents
Security Whitepaper
The Security Whitepaper gives you the complete overview of how CloudTalk protects your data: where it is hosted and who can access it, how it is encrypted, how we test and monitor the platform, and what happens when something goes wrong.
Certifications & Reports
Data Privacy
Frequently asked questions
Yes, we support Google, Okta, Azure, OneLogin, Keycloak, Salesforce or standard email and password authentication.
No, by default CloudTalk does not have access to your systems / environments. We can access some of your data only if an integration (native or through API) is in place.
For example, this could be pulling your contacts data from your CRM so you can use them in CloudTalk and editing the data in your CRM if you edit the data in CloudTalk.
SK2023648891
367170001 (DUNS number of CloudTalk s.r.o., Slovakia)
496895167 (DUNS number of CloudTalk s.r.o., Czech Republic)
471885078 (DUNS number of CloudTalk Spain SL, Spain)
145207269 (DUNS number of CloudTalk.io, Inc., USA)
CloudTalk is not an ATDS according to the TCPA as we do not provide random or sequential number generation. Using CloudTalk in a compliant way is the caller’s responsibility and typically requires having valid prior express written consent for marketing calls or texts, strictly honoring national and internal Do-Not-Call obligations, and ensuring that dialing technologies do not fall within the TCPA’s definition of an autodialer (i.e. systems using random or sequential number generation), or are otherwise used only where appropriate consent exists.
46817832
By default, CloudTalk retains your data for as long as your account remains active and for 3 months after account closure. Following this period, the data is automatically removed from our daily backups within 1 month. This retention policy helps prevent complications in cases of temporary account closures, such as those caused by expired payment methods or other issues. Call Detail Record (CDR) data is retained in accordance with applicable local regulations.
If you wish to have any data permanently deleted from your account, you may send your request to [email protected].
Yes, but it depends on the use case and how exactly you use CloudTalk.
Our Privacy Notice describes which data we process as the Data Controller. This is data related to you as our customer, such as your billing and contact details.
As the Data Processor, we may process any data of your customers which are shared on a contact level (name, phone number, email…) or during calls (if AI features or call recordings are used).
CloudTalk is fully GDPR-compliant, and all customer call recordings and AI-generated data (transcripts, summaries, insights) are stored exclusively in the EU.
To ensure global call quality and low latency, we use multiple AWS regions, which means some infrastructure components process other data outside the EU (US, Singapore, Australia, Brazil). Any such transfers are strictly governed by GDPR-compliant safeguards. We have DPAs with all sub-processors, including Standard Contractual Clauses, and all our infrastructure providers participate in the EU–US Data Privacy Framework, placing these transfers under the EU adequacy decision. We also conduct Transfer Impact Assessments for all non-EEA transfers. You can review our documentation at trust.cloudtalk.io
Call recordings and AI data, such as call transcripts are stored in Germany, EU. Other data maybe processed and stored in secure Amazon AWS data centres, located in five AWS regions: Frankfurt (eu-central-1), Northern Virginia (us-east-1), Singapore (ap-southeast-1), Sydney (ap-southeast-2), and São Paulo (sa-east-1). Leveraging multiple AWS regions enhances our disaster recovery capabilities, also ensuring high availability and low call latency.
Yes, we do have a DPO. You can reach our Data Protection Officer at [email protected].
Our sub-processors are listed here: https://www.cloudtalk.io/sub-processors/. Companies in the "Infrastructure" section are necessary for using any of the CloudTalk services. Sub-processors in the "AI Features" section are engaged only if AI Conversation Intelligence or Voice Agents are used. Companies in the "Integrations" section are engaged if any integration is enabled.
We have implemented a set of standard security policies and measures compliant with our ISO27001 certification and audited SOC 2 Trust Services Criteria. We are also fully compliant with key data privacy regulations, including the General Data Protection Regulation (GDPR) in Europe and the California Consumer Privacy Act (CCPA) and HIPAA in the United States. Additionally, we are PCI DSS v4.0.1 compliant (SAQ A merchant) and have completed the CSA STAR Level 1 self-assessment. These regulatory frameworks are integral to our operations, ensuring that we handle personal data with the utmost care, transparency, and accountability.
All measures are described at www.cloudtalk.io/security-whitepaper and trust.cloudtalk.io.
Yes, CloudTalk’s controls align with the requirements of DORA.
We confirm that CloudTalk's controls align with the requirements of DORA. We offer our own standard DORA addendum, available through your CloudTalk sales representative, and we are also fully open to reviewing and signing your version. We already support several customers in the financial sector who have implemented their DORA-specific contractual exhibits with us. Our security, resilience and incident-management processes already meet the underlying obligations, so this shouldn't be an issue.
