Trust and data handling

Sophiie answers calls, messages and emails for your business. This page explains where that data goes, who processes it, and what we commit to. Our privacy policy and subprocessor list have the full detail.

Where is my data stored?

Our main account database, including call transcripts and messages, is hosted in Australia. A read-only copy of some of it is also kept in the United States so we can answer calls quickly. Call recordings are created and held by our telephony providers, and most files you upload are held by our file-upload provider. These providers may store them outside Australia. When a recording is played, we also keep a copy in Australia. Other service providers process or store information overseas to deliver AI, voice, messaging, monitoring and support services. See our subprocessor list for each provider’s purpose and country.

Which providers process my calls, and where?

We use specialist providers for telephony, speech-to-text, text-to-speech and AI language models. Each one is listed, with its purpose and country, on our subprocessor list. Data we send to our AI, speech and messaging providers is encrypted in transit, and each provider is set up to receive only the data it needs for its job. Phone calls travel over the public phone network and carrier links, which are not end-to-end encrypted.

Do you use my calls to train AI models?

Sophiie does not train or fine-tune AI models on your calls, recordings, transcripts or messages. We use third-party AI services to process this information and provide the service. We use AI and voice providers under business or API terms, and we configure them so they do not use your data to train their models.

Are calls recorded?

Calls are transcribed and may also be recorded so your team can review them. Recording settings and notices vary by call type. Each business using Sophiie is responsible for telling its callers that calls may be recorded and handled by AI, as required by the laws that apply to it. Contact support@sophiie.ai for help checking your setup.

How long do you keep data, and can I delete it?

We generally keep recordings and transcripts while your account is active so you can review past interactions. Email support@sophiie.ai to request deletion or discuss retention. Call recordings held by our telephony providers are deleted on request. Account closure does not immediately erase all data from our systems and backups. We delete or de-identify personal information when it is no longer needed for a permitted purpose, unless the law requires us to keep it. Deletion timing varies by data type and system.

Who at Sophiie can access my data?

A small number of support and engineering staff, through permission-controlled tools, and only to support you or keep the service running. Staff accounts are protected by multi-factor authentication. We log support access and specified changes made within customer accounts. Your own team’s access is controlled by the roles you give each user.

Does the dashboard support multi-factor authentication?

Sophiie sign-in is passwordless: we send a one-time code or a sign-in link to your email or phone, or you sign in with Google, Microsoft or Apple and your account’s own multi-factor settings apply.

What happens if there’s a data breach?

If a breach affects customer data, we notify affected business customers promptly and provide information to help them respond. Where required by law, we also notify the OAIC and relevant individuals as soon as practicable.

Are you ISO 27001 or SOC 2 certified?

We do not currently hold ISO 27001 certification or a SOC 2 report. An independent penetration test was completed in July 2026.

Can I get a data processing agreement or security documents?

Yes. Email support@sophiie.ai to request our data processing agreement, the penetration test summary (under NDA), or help with a security questionnaire.

How will I know if your subprocessors change?

We keep the subprocessor list up to date, and we email account owners at least 30 days before a new subprocessor starts processing customer data.