(1) Are you SOC 2 Type II certified? (mature vendors are), (2) What's your encryption standard in transit + at rest? (TLS 1.2+ / AES-256 are the floor), (3) What's the default data retention period for call recordings + transcripts? (30-90 days is standard; longer raises risk), (4) Can I delete a specific customer's data on request? (required for GDPR + CCPA compliance), (5) Where are your servers physically located? (US-only is required by some BAAs + state regulations), (6) What's your breach notification SLA? (24-72 hours from discovery is reasonable), (7) Can I get an audit log of who accessed my data and when? (yes from production vendors).
HVAC, plumbing, real estate, retail — none of these are HIPAA-covered. But they all handle customer addresses, phone numbers, sometimes payment info, sometimes personal-life context ('my AC died right before my mother-in-law arrives'). A breach exposes all of that and your insurance + reputation. Treat data security like HIPAA even when HIPAA doesn't formally apply.
Call recordings have business value (training, dispute resolution, quality monitoring) but legal exposure (every recording is potentially discoverable in litigation). The pragmatic default: 30-day retention with auto-delete after that, exceptions only for specific cases (disputes flagged within the 30-day window). Some businesses opt for NO call recording at all — transcripts only — which lowers risk significantly while preserving most operational value.
Who in your organization can listen to AI-captured calls? Default in most vendor dashboards: anyone with admin access can listen to everything. Better practice: role-based access — front desk can see appointment data, manager can see all transcripts, owner can see recordings. Configure this on day 1, not after a leak.
TLS 1.3 in transit, AES-256 at rest, US-based servers, SOC 2 Type II in progress, signed BAAs available for HIPAA-covered practices, 30-day default retention with customizable options, role-based access controls, breach notification within 48 hours. The standard Pilot agreement covers all of this — no upcharge for security tier. Free 5-min audit includes security walkthrough for your specific compliance situation.