← Security

DPIA — Twilio

Privacy Impact Assessment · Risk: LOW · Reviewed 2026-07-20

1. Vendor scope

Twilio is our voice transport + SMS carrier. Calls and texts flow through Twilio's infrastructure to/from our backend.

2. Categories of personal information

  • Caller phone number (mandatory — Twilio is the telecom carrier)
  • Voice audio (real-time bidirectional stream)
  • Voice recording (when enabled by tenant)
  • SMS body content

3. Region of processing

Voice media and SMS routing transit Twilio's infrastructure as the telecom carrier. Voice recordings, when enabled, are pulled after the call into our Canadian (Montréal) object storage and then deleted from Twilio — no recordings are retained at the carrier.

4. Legal basis (Loi 25 Art. 17)

  • Twilio is a regulated telecom provider with mature DPA + comparable safeguards
  • Carrier role is intrinsic to providing voice service — no Loi 25-equivalent purely-Canadian alternative offers comparable global reach
  • Twilio does NOT train AI models on customer data
  • Twilio limits employee access to caller data to abuse investigation

5. Risk assessment

Overall: LOW. Industry-standard for any voice AI platform.

  • Unauthorized staff access: very low (SOC 2 Type II audited)
  • AI training on data: negligible (contractual prohibition)
  • US subpoena: low (Twilio resists overbroad + publishes transparency reports)
  • Datacenter breach: very low (SOC 2, ISO 27001, PCI DSS Level 1)

6. Retention at Twilio

  • Voice recordings: deleted from Twilio immediately after transfer to our Canadian storage (not retained at Twilio)
  • Call detail records (CDRs): 13 months for billing/regulatory
  • SMS records: 13 months

7. Available option: direct SIP trunking (no Twilio)

Available today: any tenant can connect their own phone system (PBX) directly to our Montréal infrastructure over a SIP trunk — inbound AND outbound calls, transfers included, without transiting Twilio. Encrypted link available (SIP over TLS 1.3 + SRTP media). For tenants adopting this mode, the scope of this DPIA shrinks accordingly: Twilio no longer sees those calls. Twilio remains the transport for Sonocall-provided numbers and SMS.

8. Conclusion

Twilio is the industry-standard voice transport for B2B voice AI. Its DPA provides protection equivalent to Loi 25 requirements. Risk is LOW. Transfer is justified.

DPA reference: twilio.com/legal/data-protection-addendum