> ## Documentation Index
> Fetch the complete documentation index at: https://docs.ouraicalling.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Trust & compliance

> Data sovereignty commitments, technical safeguards, and how to request a DPA

Famulor is built for organizations that need real answers on data protection, not just a privacy-policy link. This page summarizes the platform's sovereignty commitments and technical safeguards. It is a summary, not the DPA itself — see [Getting the full picture](#getting-the-full-picture) below for how to request the complete sub-processor list and a signed Data Processing Addendum.

<Note>
  This page is general information, not legal advice. Review your own regulatory obligations with counsel, especially for sensitive-data use cases under GDPR Art. 9.
</Note>

## Data sovereignty commitments

| Commitment                  | What it means                                                                                                                                          |
| --------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------ |
| **EEA-first processing**    | Core processing of voice and text data runs on infrastructure located in the European Economic Area.                                                   |
| **No-training guarantee**   | Your call audio, transcripts, and prompts are never used to train or improve any underlying model.                                                     |
| **Minimization by default** | [Retention](/settings/data-retention) is configurable per data channel, down to as little as one month, with automatic deletion once a record expires. |
| **Encryption everywhere**   | Data is encrypted in transit and at rest by default across the platform.                                                                               |

## Technical and organizational measures

| Measure                    | Description                                                                                                                                                                              |
| -------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| **Workspace isolation**    | Every workspace's data is logically separated from every other workspace, including the customer workspaces a reseller runs through [white-label access](/admin/tenants-and-whitelabel). |
| **Role-based access**      | Access follows least-privilege roles ([owner, admin, member, viewer, billing](/settings/workspaces)), and access-affecting actions are logged.                                           |
| **Account authentication** | Every user can enable [two-factor authentication](/account-security) — an authenticator app, email codes, or both — on top of their password.                                            |
| **Audit logging**          | **Settings → Data → Audit Log** records who changed what across the workspace, and when, for compliance review.                                                                          |
| **Backups & continuity**   | Data is backed up on a regular schedule with redundancy across the underlying infrastructure.                                                                                            |
| **Incident response**      | A documented incident-response process, including notifying affected customers and regulators within GDPR's required timeframe when a breach occurs.                                     |

Live platform availability is published at [status.famulor.io](https://status.famulor.io).

## International data transfers

Some processing steps — for example a specific language, engine, or model an assistant is configured to use — may run outside the EEA. Where that happens, the transfer relies on recognized legal safeguards: the EU Standard Contractual Clauses and, where applicable, the EU-U.S. Data Privacy Framework. Enterprise customers can request a Transfer Impact Assessment documenting the safeguards in place for their specific configuration.

## Retention and deletion

Call, message, and lead data is kept only as long as your workspace's [data retention](/settings/data-retention) settings specify, with automatic deletion once a record expires and every deletion recorded in the audit trail.

## Getting the full picture

The specific sub-processors behind each part of the platform, their processing locations, and the legal transfer basis for each are documented in Famulor's Data Processing Addendum (DPA). Email [support@famulor.io](mailto:support@famulor.io) to request the current DPA and sub-processor list — the list is reviewed on a regular cadence, so always ask for the current version rather than relying on an older copy.

See also [Support](/support) for security questionnaires and other compliance requests.