Octa handles patient scheduling for medical practices, booking for dental groups, intake for law firms, and after-hours calls for solo groomers — all on the same stack. Every tenant inherits the controls built for the most regulated one.
We hold or are actively pursuing attestations against the frameworks our customers care about. Current status, with no asterisks:
Not a roadmap. These controls are live right now, covered by our test suite, and verified by our incident runbook.
Most voice-AI vendors sell HIPAA as a premium add-on. Octa includes a signed BAA on every Business plan and above. If you can afford $349 a month, you can afford to handle PHI properly.
HIPAA Security Rule + Privacy Rule obligations. PHI-only workflows isolated with Epic FHIR integration. Breach notification coordination. Minimum-necessary access. Immutable audit trails on every PHI touch. Encryption in transit and at rest. Explicit no-training clauses with every downstream AI subprocessor.
Every vendor below has signed a DPA with a no-training clause for AI providers and a BAA where PHI applies. We do not use any customer content to train models — ours or theirs.
No marketing dodges. If something's in flight, we say so.
Yes — Octa is built on a HIPAA-ready architecture. A signed Business Associate Agreement (BAA) is bundled into every Business plan and above, with PHI handling, encrypted recordings, audit logs, retention controls, and Epic FHIR integration included. No paid add-on required.
SOC 2 Type I is in progress with a Q2 2026 target. In the meantime our controls — least-privilege access, audit logging, encryption in transit and at rest, change management, incident response — are already operating against the Trust Services Criteria. Request our current controls matrix at security@octavoice.ai.
No. We do not use any customer conversation, recording, transcript, or knowledge-base content to train AI models. Our contracts with Anthropic, Deepgram, Cartesia, ElevenLabs, and every downstream provider also forbid training on your data.
On AWS infrastructure in US regions by default, with EU residency available on Business plans and above. Databases are encrypted at rest. S3 call recordings are encrypted with SSE-S3. Backups are encrypted and retained 7 days.
Every record — call, chat, recording, FHIR identifier, API key — is scoped by tenant_id at the database and object-store layer. All API endpoints require a per-tenant token or signed Bearer key. Admin surfaces are gated behind a separate identity. Multi-tenant isolation has been in place since day one and is covered by our test suite.
Within 72 hours of discovery, per GDPR Article 33 and our customer agreement. HIPAA-covered accounts receive breach notification per the HIPAA Breach Notification Rule in parallel. Materially-affected customers also get a direct phone call from the on-call engineer.
Yes. Retention windows are configurable per tenant (default 3-30 days by plan, up to 2 years on request). You can disable recording entirely, redact PII fields, require consent prompts, and pull per-call signed URLs that expire. Deletion is immediate and audited.
Yes — a signed BAA is included at no extra cost on every Business plan and above. Email legal@octavoice.ai and we will return a counter-signed BAA within one business day.
Send a detailed report to security@octavoice.ai. We acknowledge within 24 hours, triage within 72 hours, and remediate critical issues on an emergency schedule. We appreciate coordinated disclosure and credit researchers on request.
Vulnerability reports, controls matrix, pentest summary, SOC 2 progress.
security@octavoice.aiBusiness Associate Agreements, Data Processing Addendum, EU Standard Contractual Clauses.
legal@octavoice.aiRight to access, rectify, erase, or export. Responded to within 30 days.
privacy@octavoice.ai14-day money-back guarantee. Keep your number. HIPAA, GDPR, and your legal team taken care of on day one.