Security & Trust
Sonocall's security posture, in plain language. Last updated 2026-07-20.
Data residency
Storage and processing are 100% in Canada — Google Cloud Montréal region (northamerica-northeast1): managed database, recordings, knowledge base, voice audio assets, and application compute. Automatic failover across data centers (high availability) within the region; disaster-recovery replica in a second Canadian region (Toronto) available.
Healthcare-grade tenants: Canadian-region AI endpoint with Zero-Data-Retention amendment available on request.
Encryption
- At rest: AES-256 (managed database + object storage)
- At rest (credentials): AES-128 Fernet for SIP passwords + OIDC client secrets
- In transit: TLS 1.2/1.3 for all HTTP; WSS for audio streams
- Direct SIP links: SIP over TLS 1.3 + SRTP-encrypted media (AES-128) into our Montréal servers
- Application secrets: Google Secret Manager
- Database connections: SSL enforced (encryption required)
Authentication
- JWT with bcrypt password hashing
- SSO: native OIDC (Microsoft Entra ID + Google Workspace + generic)
- MFA available (TOTP)
- Domain-based auto-redirect to identity provider
Multi-tenant isolation
Every API endpoint architecturally filters by tenant identifier. Cross-tenant access is impossible by design — enforced at the data layer.
Application firewall & anti-malware
Cloud Armor application firewall (WAF) + per-IP rate limiting at the edge. Minimal, hardened infrastructure: managed containerized services, no traditional workstations in the production path, IP-allowlisted access for telephony + container image vulnerability scanning.
Direct telephony (bring your PBX)
Your business phone system (PBX) can connect straight to our Montréal infrastructure over an encrypted SIP trunk — SIP signaling over TLS 1.3 and SRTP-encrypted audio, in transit to our Canadian servers. No US carrier in the media path, IP-allowlist or credential authentication, built for regulated environments (healthcare, finance, public sector). Classic UDP links remain available.
Audit logs
- Per-call, per-automation, per-admin-action
- Consent events (Loi 25 legal proof)
- Deletion audit log (every retention + caller-request deletion)
- Admin audit log + agent version history
Backups + DR
- Daily database backups, 7-day retention, 7-day point-in-time recovery
- Hourly object-storage sync between regions during migrations
- Per-tenant JSON backup script
- RTO: ~30 min · RPO: ≤ 24h
Sub-processors
As of 2026-06-05:
- Google (Google Cloud Platform — infrastructure + AI) — DPA signed, DPIA on file
- Twilio (voice + SMS) — DPA signed, DPIA on file
- SendGrid (transactional email) — DPA signed, DPIA on file
- Stripe (payments & billing — billing metadata only, no caller data) — DPA signed, DPIA on file
All vendors are bound by DPAs equivalent to Loi 25 requirements. None uses customer data to train AI models.
Breach response
Security incidents are notified to CAI within 72 hours per Loi 25 Art. 3.5. Incident response runbook + escalation contacts on file. Privacy Officer: privacy@sonotech.ai.
Compliance certifications
Sonocall inherits GCP's certifications (SOC 2 Type II, ISO 27001, PCI DSS Level 1, FedRAMP). For enterprise clients, we provide Loi 25-equivalent contractual commitments via our DPA; for industries requiring direct certifications, partner-led options (e.g. Kinessor's ISO 27001) are available.
Penetration testing
Roadmap: Q3 2026 first formal pentest by an accredited third party. Until then, we run continuous dependency scanning + manual code review for security-sensitive PRs.
⚠ Why your provider choice shifts YOUR liability
Under Loi 25, the business collecting the data (you, the tenant) is the data controller — not the SaaS provider. If you use a non-compliant tool, CAI holds YOU accountable, regardless of where the technical failure sits.
You are required to:
- Sign a Data Processing Addendum (DPA) with every vendor (Art. 18)
- Conduct a Privacy Impact Assessment before any cross-border transfer (Art. 17)
- Designate a Privacy Officer and publish their contact (Art. 8.1)
- Offer an accessible mechanism for data subject rights (Art. 27-28)
- Notify CAI within 72 hours of any incident (Art. 3.5)
Real risk: fines up to $25M CAD or 4% of global revenue — hit the business, not the vendor.
Most US voice AI platforms don't ship: a Quebec-specific DPA, Canadian data residency, a French DSR form, a published Privacy Officer, a retention engine. A Quebec business using them is technically in violation — and CAI goes after the business first.
Sonocall exists to close that gap: we give you all the contractual and technical pieces so YOU are compliant, not just us.
Reporting a vulnerability
Found a security issue? Email security@sonotech.ai — we respond within 24 hours. Please don't publicly disclose until we've had a reasonable chance to fix.