What this page covers
Finn touches phone calls, recordings, transcripts, and whatever personal data your callers say out loud. Three frameworks come up most often in review: HIPAA, GDPR, and SOC 2. This page explains what each one actually asks of you, what the platform does for you, and where the platform gives you nothing and you have to build the process yourself.
This is not legal advice. For that, talk to a lawyer who works on telecom or privacy in the jurisdictions you call into.
Division of responsibility
| Area | Platform | You |
|---|---|---|
| Encryption in transit and at rest | Yes | Nothing to configure |
| EU data residency | Available as an account region | Set the region at signup |
| Right-to-delete execution | Dashboard and API | Receive and triage the request |
| Recording disclosure | Optional injection under Settings → Compliance → Recording Disclosure | Decide whether your jurisdictions require it |
| PII redaction in transcripts | Opt-in under Settings → Compliance → PII Redaction | Enable it, and handle audio separately |
| Retention window | Enforced deletion after the window | Choose the window |
| Lawful basis / consent records | Nothing | Everything |
The last row is the one that gets missed. Finn has no way to know whether you had permission to call someone. If a regulator asks, the record has to come from your side.
HIPAA
HIPAA applies if you send Protected Health Information through the platform. To do that you need a signed Business Associate Agreement with FinnAI.
- The BAA is available on the Enterprise plan only.
- It must be signed before any PHI reaches the platform. Signing afterwards does not cover calls that already happened, and those recordings and transcripts still exist under your retention window.
- Appointment reminders that mention only date, time, and provider generally fall under the TPO (Treatment, Payment, Operations) exception and need no separate authorization.
- The moment the call covers diagnosis, test results, or treatment specifics, you are outside that exception and need full HIPAA handling.
The practical failure mode is scope creep in the prompt. A reminder agent that answers "so what did my bloodwork say?" has just put PHI into a transcript. Keep the script generic and use a transfer tool to route clinical questions to a human. See tools-transfer and agents-prompting.
Some states add their own disclosure requirements for AI in healthcare contexts on top of HIPAA.
GDPR
GDPR applies to EU residents regardless of where your company sits.
| Requirement | What it means for a Finn |
|---|---|
| Lawful basis | Reminders to existing customers usually rest on legitimate interest or performance of a contract. Cold outbound marketing needs explicit consent. |
| Right to delete | You have 30 days to comply. Delete via the dashboard or the API. |
| Data minimization | Only collect the post-call fields you use. Every extra extracted field is data you now have to defend and delete. |
| Data residency | EU customer data should stay in the EU. The account region is set at signup. |
The residency choice is the one with a hard edge: it is an account-level setting made at signup, not a per-agent toggle. See data-residency.
Separately, the ePrivacy Directive governs unsolicited marketing calls in member states and is stricter than GDPR alone. Default position: do not cold-call EU consumers for marketing without prior opt-in. Soft opt-in from an existing customer relationship, with a working opt-out, is usually acceptable for similar products. Consent handling for campaigns is covered in outbound-campaigns.
SOC 2
The Finn documentation set does not yet state a SOC 2 report status, audit period, or trust services criteria scope, so this page does not claim one. If you need a SOC 2 report or a security questionnaire answered for procurement, request it through support rather than inferring status from this page.
What the platform does document today, and what you can cite in a questionnaire, is narrower: encryption in transit and at rest, configurable retention with permanent deletion at the end of the window, PII redaction for transcripts, and EU data residency.
Retention and what deletion actually deletes
Recording is on by default. You can disable it per-Finn under Call Settings, or globally under Settings → Compliance.
- Default retention is 90 days, configurable up to 7 years for regulated industries.
- After the window closes, recordings are permanently deleted. There is no recovery step and no support escalation that restores them.
- A retained record includes the audio, the transcript, call metadata, and any post-call analysis fields.
PII redaction covers transcripts only. The audio is untouched. If a caller reads out a card number, redaction removes it from the transcript and leaves it in the recording. For that call you have to delete or trim the audio yourself. Details in retention and post-call-analysis.
Recording disclosure obligations, including the two-party consent states, are covered in recording-consent.