Your data is
yours alone.
Encrypted in transit and at rest. Per-tenant key isolation. Never used to train shared models. Compliance frameworks on Multi-Location & Custom. Consent-aware on every call, every state.
Security built into the platform,
not bolted on after.
The defaults are the secure ones.
Every customer gets encryption, isolation, and audit logging from day one — no checkbox to flip, no premium tier required. The platform watches its own health, too, so problems are caught before your customers mention them. Multi-Location & Custom adds signed agreements and compliance frameworks on top of those defaults.
AES-256 at rest
Every record, recording, transcript, and configuration encrypted at rest with industry-standard AES-256.
TLS 1.3 in transit
All network traffic encrypted with modern TLS. No legacy cipher suites. Strict transport security enforced.
Per-tenant isolation
Every record is scoped to your business and queried by your business ID — one customer's data is never returned to another, and credentials are encrypted at rest.
Access logging
Every access to customer data — by you, by your team, by Piquup staff — is logged with timestamp, identity, and reason.
Least-privilege access
Piquup engineers do not have routine access to customer data. Production access requires explicit authorization and is audited.
US-hosted
All data is stored in US data centers on Cloudflare's infrastructure, whose own compliance certifications are published by Cloudflare. Piquup has not yet completed its own SOC 2 audit.
Never used to train AI.
Not by us. Not by our model providers. Not by anyone.
Zero model training.
Conversation data, transcripts, recordings, and CRM data are never used to train shared, third-party, or publicly available models. Your calls don't make the next model smarter.
Zero data sales.
We don't sell, lease, or share customer data with marketing or advertising partners. Period. The only people who see your data are you, your authorized team, and the services you've explicitly connected.
Export anytime.
One click in your dashboard exports the full archive of your calls, transcripts, summaries, and customer profiles. Cancel anytime and walk away with all of it.
Recording disclosure done
automatically.
Every call, every state, every consent rule — handled before the call connects.
State-by-state consent.
California, Florida, Illinois, Massachusetts, Pennsylvania, Washington — two-party-consent states handled automatically. Disclosure played at call start. No manual configuration required.
TCPA-conscious SMS.
Recipients are tracked, consent verified before any outbound message. STOP and HELP responses honored automatically and persisted permanently. SMS opt-in data never shared.
Right-to-be-forgotten.
Customer requests to delete their data are honored across transcripts, summaries, and profiles — you can purge a customer from your dashboard, and we complete anything else within 30 days.
Compliance frameworks
on Multi-Location & Custom.
Healthcare-grade privacy practices. Legal-compliance package for firms.
If your business handles regulated data, the Multi-Location & Custom tier ships with the frameworks to handle it correctly. Signed agreements, audit support, and the technical controls regulators look for — ask us about your compliance needs.
Signed agreements
The agreements your regulated data requires, worked through with you before anything is processed.
Custom DPAs
Your data processing agreement, your terms, signed and reviewed annually. Multi-Location & Custom tier.
PHI redaction
Automatic redaction of unrelated PHI in shared transcripts and team-wide exports.
Audit exports
Full audit trail downloadable for compliance reviews, bar inquiries, or internal investigation.
Privilege handling
For law firms — privileged content auto-flagged in transcripts and access-scoped to assigned counsel only.
Retention policies
Configurable per record category. Meet whatever your regulator or your bar requires.
Questions about security?
We're happy to walk through our infrastructure, compliance frameworks, and how we handle your specific data.