Isolation and access
Each business’s workspace and data are kept separate. Access control and least privilege apply; public endpoints use TLS.
Trust center
Trust center
Everything a security review asks first, in one place: who processes your callers’ data, where, for how long, and how you hear about changes.
Sub-processors
Who processes data for Temsor
The same list as section 6 of the Data Processing Addendum (dpa@2026-10-06). It is generated from one file, so the two cannot drift apart.
| Sub-processor | Purpose | Location | Transfer basis |
|---|---|---|---|
| Contabo | server hosting for the application, databases and call media | EU (France) | DPA; processed in the EU |
| Telnyx | phone numbers, call transport (SIP/PSTN) and browser calling | US | DPA + standard contractual clauses where required |
| Microsoft Azure AI Speech | text-to-speech for IVR prompts and speech-to-text for voicemail transcripts | EU (Ireland) | DPA; processed in the EU |
| Google Cloud (Vertex AI Gemini Live API) | real-time voice AI for the AI voice agent on calls from withheld or unrecognised numbers and from Turkish (+90) numbers | EU (Google Cloud EU region) | DPA; processed in the EU |
| OpenAI | real-time voice AI for the AI voice agent, on calls from recognised international-format numbers other than Turkish (+90) numbers | US | DPA + standard contractual clauses where required |
| xAI | AI model for API product features | US | DPA + standard contractual clauses where required |
| Groq | AI call summaries (paid add-on) | US | DPA + standard contractual clauses where required |
| Supabase | sign-in and account database for the portal | US | DPA + standard contractual clauses where required |
| Resend | transactional email (sign-in codes, call summaries, notifications) | US | DPA + standard contractual clauses where required |
| Polar | payments and invoicing as merchant of record | US | DPA + standard contractual clauses where required |
| Cloudflare | DNS and network security | global | DPA + standard contractual clauses where required |
Before adding or replacing a sub-processor, Temsor updates this list and e-mails account owners at least 30 days in advance; you can object under section 6 of the DPA. Read the Data Processing Addendum
Retention
How long data is kept
Deletion is automatic; nobody has to remember to run it.
| Data | Kept for |
|---|---|
| Call records, transcripts and call traces | Deleted automatically 90 days after the call |
| Voicemail recordings | Deleted after 30 days |
| AI voice agent call audio and transcript | Not recorded or kept by Temsor; the voice AI provider may keep call data for abuse monitoring for at most 30 days (OpenAI) and cache it in memory for up to 24 hours (Google Cloud) |
| AI call summary | Deleted from memory within 3 hours after delivery to the business |
| Appointment and callback requests, call record (number, time, duration) | Deleted after 90 days |
| Account data after closure | Deleted or returned on request; legal retention duties (such as billing records) are reserved |
Source: section 7 of the Privacy notice. Read the Privacy notice
Security measures
What protects the data
Disclosure on every call
Every call opens with an AI and recording notice the business cannot switch off. Call data is not used to train AI models.
Breach notice in 48 hours
Temsor notifies the business of a personal data breach within 48 hours, with what it needs to inform regulators and the people affected (DPA section 11).
More on trust
Let Temsor answer your next call.
Build and test your first flow free in your browser. Add funds when you go live.
No card needed · $0 when idle