Trust Center
Last updated: 2026-07-08
Everything procurement, security, and legal teams typically ask about, in one place. We keep this page in sync with what the platform actually does — if you spot a gap or need something not listed, email trust@devotel.io.
Data residency
Production data is processed in the European Union. Primary workload runs in Google Cloud europe-west1 (Belgium) with a Cloud SQL cross-region read replica in europe-west2 (London) for disaster recovery.
Current limitations: we do not yet offer US-only, UK-only, or APAC-only data residency. Customers with a regulatory requirement for region-pinned processing should contact trust@devotel.io so we can scope the work; this is on the roadmap but not GA.
Inbound message and call content may transit a carrier or channel provider before reaching Orbit; each subprocessor's region is listed in the table below.
Subprocessors
Orbit engages the third-party processors listed below to deliver the service. Each is contractually required to protect customer data and use it solely for the services they perform on our behalf. For a standalone page suitable for change-notification subscription, see /subprocessors.
| Processor | Purpose | Region | Scope |
|---|---|---|---|
| Anthropic · DPA | Large-language-model inference for AI agents, classifiers, and Orby in-product assistant. | US | content, metadata |
| Google Cloud Platform · DPA | Production compute (GKE), managed Postgres (Cloud SQL), object storage (GCS), Secret Manager, Cloud Build, and observability. | EU (europe-west1, Belgium) with cross-region replica in europe-west2 (London) | account, content, metadata, telemetry |
| Clerk · DPA | User authentication, session management, multi-factor authentication, and organization membership. | US | account, auth |
| Stripe · DPA | Payment processing, subscription billing, invoice generation, and tax computation. Cardholder data never traverses Orbit systems. | US / EU (multi-region) | billing |
| Telnyx · DPA | Inbound SMS and voice termination on DIDs purchased from Telnyx. Outbound (MT) traffic does NOT flow through Telnyx. | US / EU (multi-region) | inbound only |
| DIDWW · DPA | Inbound voice and SMS termination on DIDs purchased from DIDWW. Outbound (MT) traffic does NOT flow through DIDWW. | EU (Latvia) | inbound only |
| Twilio · DPA | One-shot import path only — used at customer request to migrate phone numbers and historical message data into Orbit. No live traffic. | US | metadata |
| Deepgram · DPA | Real-time speech-to-text transcription for voice agents and call recordings. | US | content |
| Cartesia | Low-latency text-to-speech synthesis for voice agents. | US | content |
| ElevenLabs · DPA | High-quality text-to-speech synthesis for voice agents (alternate provider). | US | content |
| Devotel Orbit Media · DPA | Self-hosted WebRTC media plane (SFU) for live voice agent sessions. Runs inside Devotel’s GCP infrastructure (europe-west1); no audio data leaves Devotel’s own cluster. | EU (europe-west1, GCP) | content, metadata |
| PostHog · DPA | Product analytics, session replay (opt-in), and feature-flag evaluation. PII-redaction enabled by default. | EU (Frankfurt) | telemetry |
| Sentry · DPA | Application error and performance monitoring. PII scrubbed before transmission. | US | telemetry |
| Resend · DPA | Outbound transactional and platform-managed marketing email delivery. Customers are billed at cost plus markup; no BYO SMTP. | US | content, metadata |
| Meta Platforms (WhatsApp Cloud API) · DPA | WhatsApp Business Cloud API for inbound and outbound WhatsApp messaging. Tenants connect their own WABA (BYO). | US / global | content, metadata |
| Qdrant Cloud · DPA | Vector database for retrieval-augmented generation (RAG) over agent knowledge bases. Chunk content encrypted at rest with AES-256-GCM (enc:v1 envelope). | EU (Frankfurt) | content |
SOC 2 control mappings
Below is the mapping of major Trust Services Criteria to Orbit controls. A formal SOC 2 Type II audit is in planning; this table reflects the controls as implemented in the platform today. "Implemented" = control is live in code or infrastructure; "documented, audit pending" = control is operational but awaiting independent attestation.
| Criterion | Description | Status |
|---|---|---|
| CC6.1 | Logical and physical access controls — Clerk SSO, MFA, per-tenant API keys with rotation. | implemented |
| CC6.2 | Encryption at rest — AES-256-GCM enc:v1 envelope on PII, OAuth tokens, webhook secrets, RAG chunks. | implemented |
| CC6.3 | Encryption in transit — TLS 1.2+ on every public endpoint and every internal hop. | implemented |
| CC6.6 | Vulnerability management — dependency CVE scanning, container image scanning, quarterly review. | implemented |
| CC7.1 | Detection and monitoring — Sentry error monitoring, PostHog product telemetry, GCP audit logs. | implemented |
| CC7.2 | Security event identification — automated alerting on auth anomalies, audit-log chain breaks, secret access. | documented, audit pending |
| CC7.3 | Incident response evaluation — runbooks for provider outages, data exposure, account takeover. | documented, audit pending |
| CC7.4 | Incident response actions — post-incident review with redacted RCA published within 10 business days. | documented, audit pending |
| CC8.1 | Change management — pull-request review, pre-submit gate, blue-green Cloud Build deploys. | implemented |
AI transparency — EU AI Act Article 50
Article 50 of the EU AI Act applies from August 2, 2026 and requires that people are told when they are interacting with an AI system, and that AI-generated audio content is marked as such. Orbit's AI-disclosure controls ship the mechanics an operator needs to meet that obligation today:
- Automatic "you are speaking with an AI" notice — when enabled, Orbit prepends a configurable chat notice on an AI agent's first reply in a conversation (once per conversation) and plays a configurable voice intro (recorded audio or synthesized text) before an AI voice agent starts speaking on a call.
- AI-generated content marking — messages sent by an AI agent are stamped with
metadata.ai_generated, and recorded calls with AI involvement are stamped with EU AI Act Article 50 provenance metadata on upload. Where the configured text-to-speech provider embeds a perceptually-inaudible watermark (content-credential support varies by provider), that signal is recorded alongside the call. - Per-regulation opt-in, not automatic geo-detection — a workspace turns on each regulation that applies to its traffic (EU AI Act §50, Korea's AI Basic Act, California SB 243) under Settings → Compliance → AI Disclosure. Orbit does not infer a contact's jurisdiction from a phone number or address, so an enabled rule applies workspace-wide rather than being switched on or off per contact; the safe default when a rule is off is that its disclosure is never added.
- Exportable conformity evidence — each AI agent can generate a one-click conformity dossier mapping its transparency configuration, evaluation results, human-oversight approvals, and decision audit log to the relevant EU AI Act articles (12, 14, 15, 50), plus a tamper-evident, cryptographically signed disclosure ledger proving when and where an AI — not a human — handled an interaction.
Disclosure is off by default; a tenant operator opts in per regulation. See the EU AI Act Article 50 documentation for the configuration API and how to export verification evidence.
Documents
- Data Processing Agreement (DPA)
- Privacy Policy
- Terms of Service
- Service Level Agreement (SLA)
- Acceptable Use Policy
- Subprocessor list (standalone)
- Security overview
For a counter-signed DPA, security questionnaire response (CAIQ, SIG-Lite), penetration-test summary, or any other artifact, please email trust@devotel.io.