Where every call goes, and who sees it
Future Ready is built for contact centres that answer to GDPR. Below is each step a call takes, where it is processed, and by whom.
- Storage in AWS Stockholm
- eu-north-1
- Certified by Nemko
- ISO 27001 + 27701
- Recorded calls, no third-party API
- Self-hosted STT
Your calls stay yours.
Recordings are transcribed on speech models we run, and personal data is removed before anything is stored. Language models see text, never audio.
- Call capturedfrom your telephony
- Transcribedon models we host
- Personal data removedbefore storage
- Scoredon your rubric
- Storedencrypted, in Stockholm
CustomerMy account number is [ACCOUNT], and I live at [ADDRESS].
How we protect your data
What happens to your data, and where, from the moment a call is captured.
Storage in Stockholm
Call data, transcripts, scores and analysis are stored in AWS Europe (Stockholm), eu-north-1.
Self-hosted transcription
Recorded calls are transcribed on speech models we run ourselves, with dedicated Norwegian and Swedish models. No third-party transcription service hears them.
Automatic PII redaction
Names, numbers, emails and addresses are stripped from transcripts automatically before they are stored, though automatic removal can miss something. In Conversational Intelligence, if redaction can't be applied, the transcript is blocked rather than saved.
Encrypted throughout
TLS in transit and encryption at rest across databases, storage and logs.
Least-privilege access
Role-based access with tenant isolation between organisations. Sessions use short-lived tokens, with no long-lived credentials held in the browser.
Tested continuously
Static analysis and dependency scanning gate every change, audit logs run in production, and we commission independent penetration tests.
What language models see, and where they run
Scoring, feedback and redaction run on language models hosted by AWS Bedrock, called from Stockholm. They receive text, never audio, and nothing is used for training. By default this processing can run in AWS regions outside the EU.
Need everything in the EU?
We can keep all language-model processing for your organisation in AWS’s EU regions. Live voice calls in practice sessions and voice agents still run on Retell AI in the US.
Certified by Nemko
Future Ready AS is certified to both standards by Nemko Scandinavia AS.
ISO/IEC 27001
Information security management
- Certificate
- 904160
- Valid until
- 3 November 2028
ISO/IEC 27701
Privacy information management
- Certificate
- 904161
- Valid until
- 3 November 2028
Scope: Sales and development of software solutions and applications for AI-based training and quality assurance of sales and customer service on behalf of external clients.
Independent assurance
Penetration testing
Independent third-party testing of internet-facing apps and APIs.
Never used for training
Your conversations do not train any model.
Certified infrastructure
Our infrastructure provider AWS is independently certified to ISO 27001, 27017 and 27018 and SOC 1/2/3.
Our data processing agreement is clause 7 of the Terms of Service. The Statement of Applicability is sent on request. Read the DPA summary
Sub-processors
Every company that processes customer data on our behalf: what it does, what it sees, where, and the transfer basis outside the EU/EEA. We give at least 30 days' notice before adding one.
| Company | What it does | Data it sees | Where | Transfer basis |
|---|---|---|---|---|
| Amazon Web Services | Hosting, databases, file storage, transcription servers, sign-in and email | All customer data | Stockholm, Sweden | None needed: stays in the EU |
| AWS Bedrock | Language models for scoring, feedback and redaction | Transcript text, never audio. Not used for training. | Global AWS regions, or EU only on request | Standard Contractual Clauses. None needed with the EU-only option. |
| Supabase | Database for Conversational Intelligence, running on AWS | Transcripts, scores, teams | Stockholm, Sweden | Standard Contractual Clauses |
| Retell AI | Live voice calls: practice calls, exams, voice agents and the website widget | Live audio, transcripts, phone numbers. Retell deletes its copy within 7 days. | United States | Standard Contractual Clauses |
| Twilio | Phone lines and SMS for voice agents | Phone numbers, call details, SMS text | United States | EU-US Data Privacy Framework |
| Calendar API, to book meetings in a calendar you share with us | Invitee name and contact details, availability | Your Google Workspace | EU-US Data Privacy Framework | |
| Cloudflare | DNS, network protection and cookieless visitor counts | IP address and request details. No call data. | Global network | EU-US Data Privacy Framework |
Retell’s own providers
During a live call, Retell uses its own providers for speech recognition, voices and language models. We share the list on request.
Updated 2 November 2026.
The rules we build for
All posts
Security questions before you commit?
We'll walk your security and procurement teams through our controls, share our DPA and Statement of Applicability, and complete your security questionnaire.
Data protection & securitypost@futureready.no