Cualify.
Get started

Security · trust

Compliance is a feature, not a footnote.

We're built India-first. DPDP, DLT, calling-window enforcement, AI disclosure, and data residency are wired into the platform — not legal language we hope you skim.

DPDP Act 2023

  • Every outbound campaign captures explicit consent before dialling, versioned and stored in our consent registry.
  • DPDP data-subject requests (access, erasure, portability, consent withdrawal) are fulfilled within 30 days through the in-app inbox.
  • Voice recordings and transcripts are stored in Mumbai (ap-south-1). Default retention is 90 days; configurable per organisation up to 365 days.
  • PII (Aadhaar, PAN, card numbers) is auto-redacted in stored recordings via the post-call PII redaction worker before long-term storage.
  • Our DPO can be reached at dpo@cualify.in for any data-protection question.

TRAI / DLT compliance

  • Cualify is bring-your-own-carrier (BYOC). You connect your existing telephony provider (Exotel, Plivo, Twilio, or others) and your DLT registration stays under your entity — Cualify never originates a call from our own number.
  • Our platform enforces the rules on top of your telephony: every campaign respects TRAI's 09:00–21:00 IST calling window (configurable per state), every dispatch refuses to fire if your DLT template ID isn't attached, and the AI disclosure clip plays in the first 5 seconds of every outbound call in the conversation language.
  • Every campaign number is checked against Cualify's DND list and your opt-outs before it is dialled, whichever carrier you use. No live NCPR feed is connected yet, so keep scrubbing against NCPR as your DLT registration requires.
  • We provide the audit trail (consent capture, template-id-on-dispatch, calling-window enforcement, disclosure-played logs) that your DPDP / TRAI auditor needs. You stay the Principal Entity; we give you the receipts.

Data residency

  • Postgres runs on Supabase ap-south-1 (Mumbai). Read replicas in ap-south-1.
  • Recordings, transcripts, and exports live in Cloudflare R2 with the bucket pinned to Asia jurisdiction.
  • PostHog product analytics is hosted in the EU (eu.i.posthog.com). Its cookies, like Google Analytics', are optional: declining in the cookie banner switches both off.
  • No PII leaves Indian soil without an executed DPA and your written instruction.

SLA & status

  • 99.5% uptime on every paid plan — the SLA does not change with what you spend.
  • Status page lives at /status, refreshed daily.
  • Credits are issued automatically against the next month's invoice if we miss our SLA in any 30-day window.

Sub-processors

Every third-party that processes customer or end-recipient data on our behalf. We notify org owners by email 30 days before adding or replacing any entry below — your objection right is documented in our DPA, §4. The same list is published as a legal document at /legal/sub-processors.

Last updated 2026-11-07

  • Exotel

    End-recipient data

    Telephone carrier that places and receives calls on our numbers and streams their audio to our voice runtime.

    Accesses: Phone numbers of the people your agent calls or who call you, call audio while the call is live, and call records (times, durations, status).

    Privacy ↗

  • Fly.io

    Mumbai, India

    End-recipient data

    Hosts our voice runtime, which runs each conversation between the phone line and the speech and language models.

    Accesses: Call audio and the text of the conversation while the call is live, the call recording before it is stored, and your agent's prompt and settings.

    Privacy ↗

  • Supabase

    End-recipient data

    Managed Postgres database that stores the application's records, and the storage that holds call recordings.

    Accesses: Account, organisation and billing records; contact lists, call records, redacted transcripts and call recordings for the people your agent calls; business-verification details you submit.

    Privacy ↗

  • Vercel

    End-recipient data

    Hosts the website, dashboard, API and background jobs, and stores the business-verification documents you upload.

    Accesses: All application data while it is being processed, including contact and call data; request logs; PAN card, GSTIN certificate and promoter ID documents.

    Privacy ↗

  • Inngest

    End-recipient data

    Background job queue that dispatches campaigns, sets up calls and runs scheduled tasks.

    Accesses: Job payloads and step results, including the phone numbers and names of the people being called, call IDs and account email addresses.

    Privacy ↗

  • GitHub

    End-recipient data

    Runs the nightly database backup and stores each backup for 30 days.

    Accesses: A copy of the application database, covering the records described under Supabase.

  • OpenAI

    United States

    End-recipient data

    Language model that writes the agent's replies during a call, and summarises the call afterwards.

    Accesses: Your agent's prompt and the text of the conversation. The after-call summary is made from the transcript with phone numbers and other identifiers already redacted.

    Privacy ↗

  • Sarvam AI

    End-recipient data

    Speech-to-text and text-to-speech during calls, in Hindi, English and other Indian languages.

    Accesses: Audio of the person speaking on the call, and the text of the agent's replies, which can include details from the conversation.

    Privacy ↗

  • Clerk

    Sign-in, sessions, team invitations and organisation membership.

    Accesses: Names, email addresses, sign-in credentials and MFA factors of you and your team.

    Privacy ↗

  • Razorpay

    Payments for plans and credit packs.

    Accesses: Organisation name, billing email address and payment amounts. Card and UPI details are entered directly with Razorpay and never reach our servers.

    Privacy ↗

  • Resend

    Transactional email, contact-form messages and the newsletter.

    Accesses: Names, email addresses, organisation name and message content; contact-form submissions and newsletter sign-ups.

    Privacy ↗

  • PostHog

    EU

    Product analytics for the website and dashboard.

    Accesses: Page views and product events, browser and device details, IP address, a pseudonymous identifier stored in a cookie, how you first reached our site (campaign tags, referring site, landing page), the email address used to sign up, and your workspace's name.

    Privacy ↗

  • Google Analytics (Google LLC)

    Website analytics: where visitors come from and which pages they view.

    Accesses: Page views and sign-up milestones, browser and device details, IP address (used by Google to estimate location), and a pseudonymous identifier stored in a cookie. No names, email addresses or call data.

    Privacy ↗

  • Sentry

    Error monitoring.

    Accesses: Error reports: stack traces, request details, and browser and device information. Error text can occasionally include data from the request that failed.

    Privacy ↗

  • Pusher

    Live updates in the dashboard.

    Accesses: Organisation, campaign and call identifiers and call status changes.

    Privacy ↗

  • Setu

    Checks your GSTIN against the GST registry during onboarding.

    Accesses: Your organisation's GSTIN and the registration details the registry returns.

Vendors marked with the warning dot process end-recipient personal data (the people your AI agent calls). Vendors without the dot only see Customer (your team) data.

Customer KYC on Cualify

We verify the businesses on our platform so the people your AI agent calls aren't getting dialled by an anonymous shell. Two layers stack:

1. GSTIN verified via registry

Org owners click Verify with GST registry in settings. We hit the official GST registry through Setu, fingerprint the legal name + trade name + state + status, and timestamp the verification. Verified orgs get a green badge across the platform.

2. PAN + GSTIN certificate on file

Customers can upload their PAN card and GSTIN certificate (PDF / JPG / PNG / WebP, max 5 MB). Files are stored in our Mumbai region with unguessable URLs. Useful when procurement teams want to see the actual certificate, not just an API-verified result.

Workspace-email enforcement is currently disabled, so an org owner can register on a personal email. When it is re-enabled the owner will need a company-domain address before a paid plan can be activated. Read the policy.

Have a security question?

Email dpo@cualify.in and we'll respond within 2 business days. Custom DPAs are signed with all paid tiers above Pilot.