Trust center
Compliance, explained plainly
This page brings together how CustomWeb Agents protects data, which providers help us deliver the service, and the documentation you can review before getting started. It describes our current practices; it is not a claim that we hold a SOC 2 or ISO certification.
Last reviewed: 2026-06-21
Security posture
TLS, hardened headers, access controls, and protected secrets.
ReviewProvider transparency
Every service provider, purpose, region, and privacy policy in one register.
ReviewPrivacy documentation
Retention, data handling, and account rights explained in our policy.
ReviewHow we support GDPR-aware operation
GDPR compliance depends on the setup, people, and purposes involved—not just the software. These are the controls and documentation CustomWeb provides to help a customer configure and operate an account responsibly.
Data minimization
Send only the information needed for the selected agent, AI, voice, or telephony function. Provider purposes and data types are documented in the register.
Retention and deletion
Account controls support configurable call-recording retention, while privacy requests provide a documented path for export and deletion requests.
Access and security
Clerk authentication, bearer-key controls, encrypted infrastructure, HTTPS, security headers, and server-side secrets protect account data.
Consent and notices
Customers control their own caller notices and recording consent. Recording is opt-in, and customers remain responsible for lawful disclosures.
International transfers
Processing regions and provider privacy terms are listed publicly. Customers should review transfer mechanisms and DPAs for their use case.
Data-subject rights
People may request access, correction, deletion, restriction, objection, or export through the privacy contact process.
Are we GDPR compliant?
Our practices are: data minimization, EU hosting options, named sub-processors, provider no-training opt-outs, and encryption/access controls are all genuinely in place today. What isn't in place yet is the legal layer around our sub-processors — specifically, an appointed EU representative (GDPR Art. 27) and executed Data Processing Agreements per sub-processor (Art. 28).
So the honest answer is: not fully GDPR compliant, because those sub-processor relationships aren't legally formalized yet — not because the platform itself handles data incorrectly.
Broken down by provider: our core infrastructure providers (Twilio, Stripe, Clerk, Vercel, Hetzner, Render, Supabase, Upstash, Resend) each publish a standard Data Processing Addendum and support appropriate cross-border transfer safeguards — though, per the gap above, we haven't separately executed a DPA with each of them yet. The remaining gap toward full GDPR compliance sits both there and with the AI model sub-processors (LLM, speech-to-text, and text-to-speech), whose data-residency and retention practices vary by provider — see the full sub-processor register for the per-provider breakdown.
Customer responsibilities
- Configure a lawful purpose and appropriate notices for your callers
- Use provider and recording settings that match your jurisdiction and contract
Documentation
We don't publish a one-size-fits-all DPA — every customer's data flows and sub-processor mix differ, so DPA requests are handled individually per customer rather than as a generic downloadable document.
Core infrastructure providers
The providers behind hosting, auth, billing, and data storage. Names link to their public privacy or trust documentation.
Each of these providers publishes a standard Data Processing Addendum (Article 28) and supports appropriate cross-border transfer safeguards (Standard Contractual Clauses and/or an EU-US Data Privacy Framework certification) — we haven't separately executed a DPA with each of them yet (see "Are we GDPR compliant?" above).
Plus 11 AI model providers (LLM, speech-to-text, text-to-speech) — fully disclosed on the full sub-processor register.