Company

Built for procurement. Built for trust.

Compliance, security, privacy, and governance for the AI customer engagement platform, ready for your procurement review on day one.

Compliance and certifications

Independently audited controls covering security, availability, and confidentiality. Report available under NDA.

Full compliance with EU General Data Protection Regulation. DPA available pre-contract.

End-to-end encryption in transit (TLS 1.3) and at rest (AES-256). Per-tenant keys.

How customer data is protected, processed, and isolated.

Logical tenant isolation, every customer has a dedicated tenant boundary; no shared data
Data residency configurable across US (us-east, us-west), EU (eu-west), and India (ap-south)
Encrypted backups with point-in-time recovery and geo-redundancy
Vulnerability scanning, penetration testing, and bug bounty program
24/7 security monitoring with incident response runbooks

Integrate with Okta, Azure AD, Google Workspace, Ping Identity, OneLogin, and others.

Granular permissions per role, per team, per data scope. Audit every access.

Automated provisioning and de-provisioning via SCIM. Quarterly access review.

Customer data is owned by the customer: Ephanti acts as a processor, not a controller
Configurable data retention with hard-delete on request
No training of foundation models on customer data without explicit, separate consent
Right to access, port, and delete personal data per GDPR Article 15–17
Subprocessors are documented, reviewed annually, and notification provided 30 days before any change

Every agent action, every override, every escalation, captured and searchable.

Every agent decision, system action, human override, and configuration change.

Live dashboards for conversation volume, agent latency, escalation rate, sentiment.

Trigger alerts on anomalies: volume spikes, sentiment drops, integration failures.

The third-party providers that process customer data on Ephanti's behalf.

Provider	Purpose	Region
Amazon Web Services	Cloud hosting and infrastructure	US / EU / India
Microsoft Azure	Cloud hosting (enterprise customers)	US / EU
OpenAI / Anthropic / Google	Foundation model inference (configurable)	US / EU
Twilio	SMS and voice channels	Global
Datadog	Observability and monitoring	US
Sentry	Error monitoring	US

Full subprocessor list available in the DPA. Notification provided 30 days before any change.

Available under NDA via your account team.

Standard GDPR-compliant DPA. Customised versions available for enterprise tier.

Full independently audited controls report. Available under NDA.

Architecture, controls, encryption, identity, audit. Available on request.

Pre-contract security reviews, custom DPA negotiations, vendor risk questionnaires. We handle them all.