Data Security

Ender Turing handles sensitive customer-conversation data at scale — voice calls, chat transcripts, email, and ticket content from regulated industries like banking, insurance, and healthcare. Security isn't a marketing layer; it's a core engineering constraint.

This page documents our current security posture: the certifications we hold, how data flows through our systems, who can access what, and how we respond when something breaks. Which plan includes which control — SSO, custom roles, audit logs, HIPAA with a BAA, US/EU hosting region, customer-managed keys, private cloud or on-premise — is listed in the plan comparison. For Enterprise customers, this page is the public-facing summary — the full Trust & Compliance pack (SOC 2 report, penetration-test results, infrastructure diagrams, sub-processor list with detail) is available under NDA.

This page describes how the Service works today and can change; it is not a contract. Your agreement with us governs: for Enterprise customers, the signed data and privacy agreements; for others, the Terms of Use.

We hold and maintain the following certifications and align with the following frameworks:

• SOC 2 Type II — independently audited security, availability, and confidentiality controls. Continuous observation period, latest report available under NDA; current controls in our Trust Center. See announcement.
• GDPR-compliant — DPA available, lawful-basis tracking, right-to-erasure workflow, audit logs
• HIPAA — on the Enterprise plan we sign a Business Associate Agreement (BAA), with hosting in the US region or fully on-premise
• PCI DSS 4.0.1 aware — anonymization can mask card data in transcripts, configured per language; we don't process card payments ourselves
• EU AI Act monitored — we track our controls against the Act: deployer logs, fundamental-rights impact assessment templates, transparency materials
• ISO 27001 aligned — controls mapped to the ISO 27001 framework; formal certification on our roadmap
• ISO/IEC 42001 in progress — the standard for managing AI systems responsibly; our controls are monitored continuously in Vanta, and certification is in progress

Customer data is encrypted in transit and at rest:

• In transit: TLS 1.3 with strong cipher suites and HSTS
• At rest: AES-256 in our managed cloud (AWS / GCP); customer-managed keys (CMK) available
• Backups: encrypted, and kept for a limited time
• Application secrets: kept in a managed secrets store with restricted access

Access to customer data is governed by least-privilege principles:

• Customer admins control all in-product access via Role-Based Access Control (RBAC). Built-in roles, plus custom roles and permissions.
• SSO via SAML 2.0 / OIDC. Active Directory and Azure AD supported.
• MFA available through single sign-on.

Where your data lives can be your choice (see the plan comparison):

• EU region: our default hosting. Some processing, such as backups and vendor services, can happen elsewhere
• US region
• On-premise: full deployment in your own VPC, data center, or air-gapped environment — one-time setup fee depending on scope
• Customer data isolation: logical isolation between customers; physical isolation available on dedicated-tenant deployments
• AI features: we build and run our own speech recognition (see § 8). On top of it, AI features such as AutoQA, summaries, topics and EnderGPT send the conversation and its details to a language model from the providers in that section. We may switch to whichever model is more accurate and efficient. These language models may run anywhere in the world. You decide what is sent, in the product or by asking us: which conversations go to which AI task, and whether masking is on, off or configured your way. Unless you decide otherwise, our default settings apply. Masking works on the transcript text as configured and may not cover every detail, such as caller ID. You can also choose the provider and model, use your own Azure OpenAI deployment, or run Ender Turing in your own cloud or on-premise (see the plan comparison).

If something goes wrong, we respond on a best-efforts basis:

• On-call coverage on a best-efforts basis
• Severity classification of each incident
• Customer notification without undue delay for any incident affecting customer data; for Enterprise customers, as their signed agreement provides
• Post-incident review shared with affected customers, including root cause and remediation
• Status page updated during ongoing incidents — status.enderturing.com

Report a vulnerability or suspected incident: security@enderturing.com. We acknowledge as soon as we can.

The platform keeps audit logs of key actions for a limited time.

We use a small set of vetted sub-processors to operate the Service, each under its own data-processing terms where applicable. To verify them, write to compliance@enderturing.com. They include:

• AWS — cloud infrastructure (EU region by default)
• GCP — cloud infrastructure for select workloads
• Google Gemini, OpenAI, Azure OpenAI — language models for AI features; we or the customer choose which, and Azure OpenAI can be a private deployment in the customer's own cloud (see § 5)
• Datadog — observability & metrics (EU instance)
• Sentry — error tracking (self-hosted on our infrastructure)
• Stripe — payment processing (PCI DSS Level 1)

Not every AI model we use comes from a vendor. We build our own speech recognition in-house, and we run it ourselves, along with other models such as speaker separation and punctuation.

Enterprise customers get the full list, and notice of new sub-processors that handle their data, as their signed agreement provides.

Security is shared. Some responsibilities sit on your side:

• Configure RBAC roles & permissions appropriately for your team
• Enforce strong password policies and MFA for your users
• Promptly remove access for departing employees
• Review audit logs periodically for anomalies
• Notify us immediately of any suspected unauthorized access
• Ensure conversations you upload comply with your own data-collection consent obligations
• Choose which conversations go to which AI task and how masking is set, and make sure you have the right to send that data to language models, including outside the EU
• If your conversations include health data, check with us which AI tasks your BAA covers before you use them

We welcome reports from security researchers. If you've found a vulnerability:

• Email security@enderturing.com with details (steps to reproduce, impact, affected URLs)
• Don't publicly disclose until we've had a chance to fix — we aim to triage and fix as soon as we can
• Don't access or modify customer data, disrupt the service, or test against accounts you don't own
• We don't run a paid bounty program, but we publicly credit responsible disclosures (with your permission)

External security assessments are part of our annual cadence:

• Annual penetration tests by a third-party firm — covering web app, API, and infrastructure
• Regular internal security reviews by our engineering team
• Dependency and container scanning in our build pipeline

Results summaries are available to Enterprise customers under NDA.

For security-specific inquiries, vulnerability reports, or compliance questions:

• Security: security@enderturing.com
• Privacy / DPO: privacy@enderturing.com
• Compliance & audit evidence: compliance@enderturing.com
• Postal: Ender Turing OÜ, Kõivu tee 36, 12112 Tallinn, Estonia