Security & data
Built like it will be audited.
JDAI.Solutions builds every AI system inside accounts you own, so a security review of our work is mostly a review of infrastructure you already control. Below are the questions an AI vendor security questionnaire asks, answered in plain language. If yours is not here, email contact@jdai.solutions and we will answer in writing.
Ownership
- Every system is built inside cloud accounts, repositories and vendor accounts that you own. We are added as collaborators and removed on request.
- Secrets live in your environment configuration, never in code, never in chat.
- Handover documentation lists every account, key and integration.
Access
- Access to your systems is limited to the two founders, Jeremi Jarosz and Dominik Macioszek. No subcontractor, offshore team or account manager is ever given it.
- Each of us signs in with a personal login and two-factor authentication on every account. Nothing runs on a shared password.
- We ask for access one system at a time, and only to the systems the current stage of the work needs.
Data flow
- Personal data moves: caller → voice platform → your database → your CRM → alert to you. It does not pass through JDAI-owned infrastructure.
- Model providers are used for inference only; we opt out of training-data retention wherever the provider offers it.
- Row-level security is on by default. Public policies: none. Service keys stay server-side.
- Between the platforms, data travels over encrypted connections (TLS), and your database encrypts what it stores (AES-256).
What an agent can do
- An agent reaches only the systems you approve, and where a system allows it, its access is limited to the actions the agent actually performs.
- What it may say is written down and approved by you before it takes a call: what it can promise, what it must never quote, and when a person takes over.
- The model behind it sees only what one answer needs: the conversation in progress and the documents you approve.
AI calls and recordings
- Agents identify themselves as AI. Recording consent is announced where required (two-party consent states, EU).
- Recordings and transcripts are stored in your accounts with a retention period you set. Default: 90 days.
- Callers can ask for a human at any point; the agent hands off with a transcript.
- Outbound calls and texts go only to people who have agreed to receive them. The FCC ruled in 2024 that AI voices fall under the TCPA, and business texting in the US runs on a registered A2P 10DLC line.
Healthcare and HIPAA
- A HIPAA compliant AI receptionist needs every platform that touches patient data covered. Retell, Twilio, OpenAI, Anthropic, Supabase and Vercel each offer a business associate agreement on their eligible plans.
- Telegram offers none, so a healthcare build sends its alerts another way.
- The agent never gives clinical advice. It books and reschedules, passes anything clinical to your staff, and tells an emergency caller to hang up and call 911.
Sub-processors
- Voice: Retell, ElevenLabs, Twilio · Models: OpenAI, Anthropic · Data: Supabase, Vercel · Messaging: Telegram, Resend.
- Region is chosen per client (US or EU) where the provider offers it.
- The full list with purposes and regions is published at /legal/subprocessors and updated before any change.
Agreements
- We sign a Data Processing Agreement on request (GDPR Article 28 terms for EU clients).
- NDAs before any audit that touches production data.
- If your procurement or IT team has a security questionnaire, we answer it in writing and can supply architecture diagrams.
FAQ
Questions procurement asks
01Do the AI models learn from our data?
No. We use OpenAI's and Anthropic's business APIs, and both state that data sent through them is not used to train their models by default. OpenAI keeps abuse-monitoring logs of API requests for up to 30 days, unless the law or a safety concern requires longer.
02Do you hold SOC 2 or ISO 27001 certification?
JDAI.Solutions has not been through its own SOC 2 or ISO 27001 audit. The main platforms that hold and process your data have: Supabase, Vercel and Retell have SOC 2 Type 2 reports, Twilio and Vercel are ISO 27001 certified, and we tell you where to request each report when we answer your questionnaire.
03What happens if there is a security incident?
We tell you in writing without undue delay and no later than 48 hours after we become aware, as the DPA sets out: what happened, which data was involved and what we have done so far. If a platform in the path reports a breach, or a password or key could have been seen by anyone it was not meant for, we change it the same day.
04What happens to our data when the engagement ends?
Nothing moves, because it was always in your accounts. You remove our access, we confirm in writing that we hold no copies of your data or keys, and if you want recordings and transcripts deleted as well, we delete them on every platform in the path and confirm when it is done.
05Can our data stay in the EU?
Your database and hosting can run in EU regions. The voice platform and the language models process in the US, and those transfers rely on the EU-US Data Privacy Framework or Standard Contractual Clauses, as the DPA sets out. The region for each part is written down for each engagement.
06Do you use our data for anything else?
No. Your data runs your system and nothing else. It is never used to build or train anything for another client, and nothing from it is published without your written permission.
Related: Privacy · DPA · Sub-processors
Next step
Your next system starts with twenty minutes.
A complimentary audit, run by an engineer. A fixed quote before anything is built. The audit is yours to keep, whichever way you decide.
- Reply within one business day
- You talk to an engineer, not a sales team
- Code and accounts stay yours