Which security questions to ask a voice AI vendor: a checklist before you connect
Sado AI team · · 4 min read
In short
A voice AI vendor gets your phone number, your customer list and your call recordings, so check its security before you sign. The key questions: how long are recordings kept and can they be deleted, are passwords and keys encrypted, does each employee get a login and each key its own scopes, can you stop calls yourself, is “don’t call me” respected, does the operator avoid making things up, and does it say it’s an AI when asked. Then verify all of it on test calls.
Why ask before you sign
Connecting a service means handing it three valuable things: access to your number (SIP login and password), your customer list and every day’s conversations. Switching vendors or getting data back later is hard. So get clear answers in advance and keep them in writing.
Twelve security questions
| Question | Good answer | Red flag |
|---|---|---|
| How long are recordings and transcripts kept? | A limited, clear period | “Forever”, “we don’t know” |
| Can we ask for data to be deleted? | Yes, on request | No clear answer |
| How are SIP passwords and keys stored? | Encrypted | They ask for the password in a chat |
| Does each employee get their own login? | Yes | One shared login |
| Do API keys have scopes? | Each key has its own scopes | One key for everything |
| Are webhooks signed? | Yes, the signature can be checked | No signature |
| Can we stop calls ourselves? | One button; hours and limits are yours | Only through the vendor, on request |
| How is “don’t call me” handled? | That number is never called again | Manually, sometimes |
| What does the operator do when it doesn’t know? | Doesn’t invent; creates a task for a manager | “It always answers” |
| Does it say it’s an AI when asked? | Yes | Introduces itself as a person |
| Whom may it call? | A basis is required: an enquiry or consent | “We’ll supply a list” |
| Can we see each call’s recording and cost? | Yes, call by call | Only a monthly total |
What to put in the contract or in writing
- The data belongs to your company: the customer list, recordings and transcripts.
- Retention period and deletion procedure: where to write and how many days it takes.
- What happens to the data when the contract ends.
- If something goes wrong: who tells whom, and how fast.
- Where the data is stored. Uzbekistan has a law on personal data: ask a lawyer which requirements apply to your field.
Check the answers yourself: six steps
- Call in yourself and ask: “Are you a robot?”
- Ask something that isn’t in the company facts: does the operator invent an answer or say a manager will call back?
- On a test outbound call, say “don’t call me again” and check that the number gets no more calls.
- Press the stop button and see that calls really stop.
- Check that each call in the portal shows its recording, transcript and cost.
- Ask for a separate login for an employee, then ask for it to be closed: did access end at once?
How Sado answers these questions
Sado is made by FERATECH LLC in Tashkent. Data is protected: keys are encrypted, your SIP password is stored encrypted, storage time is limited, and you have the right to have data deleted. An API key is shown only once, each key has its own scopes, and webhook requests are signed with HMAC-SHA256: see for developers.
Calling hours, the daily limit and the stop button are in your hands. People who opted out get no more calls, and only people you may call go on the lists. The operator answers only from your company’s facts and, when asked, says it isn’t human. Each call’s recording, transcript and cost are in the portal. Short answers are in the FAQ; the comparison with a call centre is in AI operator vs call centre. Check for yourself: try it live or call 78 778 01 23.
Questions
What written answer should we ask a voice AI vendor for?
A short document: how long data is kept, how it is deleted, who has access and what happens when the contract ends. Check the personal data requirements with your lawyer.
How do we compare a call centre and an AI service on security?
Ask both the same questions. In a call centre many people often listen to recordings, so pay special attention to “who has access?”.
Can we give a real customer list during the trial?
Test on yourself and your staff first, then start with a small list. It should hold only people you may call.