Encryption
Detail
TLS on all communication with our services and with customer systems. Data at rest is stored encrypted. Integration credentials live in a secret manager, never in configuration or in code.
Security and compliance
What your IT team is going to ask us, published in advance
This page is written for whoever has to approve the project, not for whoever buys it. Architecture, encryption, access, sub-processors and retention, at the level of detail we would put in a security questionnaire. Where something is not certified yet, we say so.
- Processing declared in the DPA
- Encrypted in transit and at rest
- DPA and sub-processor register
Data protection
How data is protected, layer by layer
Access control
Detail
Role- and project-based access, named, with two-factor authentication. Our team reaches customer data only when a piece of work requires it; access is temporary and withdrawn when it closes.
Auditability
Detail
Every operation on personal data is logged: who, when, on which record and why. Logs are retained for the agreed period and available for audit.
Per-customer segregation
Detail
Each customer’s data is logically separated. A flow cannot read or write another customer’s data, and integration keys are isolated per project.
Minimisation
Detail
The agent receives only the fields its flow needs. If an appointment-confirmation flow does not need clinical history, it is not given access to it.
Secret management
Detail
Credentials for your systems are rotated as agreed and never shared by email or chat. Rotation is documented.
GDPR
Our role: data processor
When Elop processes data on your organisation’s behalf, you are the controller and we are the processor. That relationship is formalised in a DPA before the first call, not after the pilot.
The DPA covers purposes, data categories, retention periods, sub-processors, security measures, the breach notification procedure, and the terms for return or deletion at the end of the contract.
Read the full DPAWhat the agreement covers
- Purposes and categories of data processed, flow by flow
- Retention periods and deletion policy
- Sub-processor register and prior notice before adding a new one
- Technical and organisational measures applied
- Breach notification procedure and timescales
- Assistance with data subject rights requests
- Return or deletion of data at the end of the contract
- Audit terms
What is stored
What data is processed, and for how long
Specific periods are set with you in the DPA. These are the defaults where nothing else is agreed.
| Purpose | Default retention | Configurable | |
|---|---|---|---|
| Contact and identification data | Carrying out the requested task | Duration of the contract | Yes |
| Scheduling data | Reading and writing appointments or bookings | Duration of the contract | Yes |
| Call transcript | Recording the outcome and quality audit | 90 days | Yes |
| Audio recording | Quality control, if enabled | Off by default | Yes |
| Call metadata | Service metrics and billing | 24 months | Yes |
| Access logs | Auditability and security | 12 months | No |
Audio recording is off unless your organisation explicitly enables it and the caller is informed under the recording clause we publish.
Continuity
What happens when something fails
The right question is not whether a system can go down, but what happens to your calls when it does.
- Failover
To your existing number
If the service does not answer, calls go to your switchboard. Tested before production.
- Alerting
Continuous monitoring
Availability and call quality watched automatically, with alerts to the team.
- Backups
Backup and restore
Regular backups of configuration and operational data, with restore tested.
- SLA
In writing
Service levels and response times agreed in contract and reviewed with you.
The security questionnaire, answered
The questions that appear in nearly every vendor questionnaire. If yours has one we have missed, ask us.
Do you hold ISO 27001 or SOC 2?
Not yet. We apply the technical and organisational measures described on this page and in the DPA, but we do not hold the formal certification — and telling you otherwise would be found out in the first audit. If your procurement process treats it as a blocking requirement, say so early so we do not waste your time.
Where is data hosted?
On infrastructure located in the European Union. The sub-processors involved and their locations are listed in the DPA, and any new addition is communicated to you before it takes effect.
Do you use third-party models? Do they see our data?
Yes, we use third-party models for voice and language, and they are declared as sub-processors in the DPA with the corresponding safeguards. We contract terms that exclude the use of submitted data for training.
Can you sign our DPA instead of yours?
Yes, we will review it. We also accept customer security annexes. What we will not do is sign without reading: if there is something we cannot meet, we tell you before signing it.
How is a patient’s or customer’s erasure request handled?
You pass us the request and we carry out the deletion within the agreed timescale, including transcripts and recordings where they exist, with a record of the operation. The procedure is in the DPA.
What happens to our data if we stop being a customer?
Whatever we agreed: return in a structured format, deletion, or both in sequence. It is executed within the agreed period and we send you confirmation of the deletion.
Do you carry out security testing?
We review dependencies and configuration continuously and remediate vulnerabilities according to severity. We can coordinate a penetration test with your team or a third party, with scope and window agreed in writing.
Missing something you need in order to approve it?
Send us your organisation’s questionnaire and we will answer it in full. If there is a requirement we cannot meet, we will tell you before you spend time on the project.