Skip to main content

Security and compliance

Compliance overview

What the platform covers and what stays your obligation.

What this page covers

Finn touches phone calls, recordings, transcripts, and whatever personal data your callers say out loud. Three frameworks come up most often in review: HIPAA, GDPR, and SOC 2. This page explains what each one actually asks of you, what the platform does for you, and where the platform gives you nothing and you have to build the process yourself.

This is not legal advice. For that, talk to a lawyer who works on telecom or privacy in the jurisdictions you call into.

Division of responsibility

AreaPlatformYou
Encryption in transit and at restYesNothing to configure
EU data residencyAvailable as an account regionSet the region at signup
Right-to-delete executionDashboard and APIReceive and triage the request
Recording disclosureOptional injection under Settings → Compliance → Recording DisclosureDecide whether your jurisdictions require it
PII redaction in transcriptsOpt-in under Settings → Compliance → PII RedactionEnable it, and handle audio separately
Retention windowEnforced deletion after the windowChoose the window
Lawful basis / consent recordsNothingEverything

The last row is the one that gets missed. Finn has no way to know whether you had permission to call someone. If a regulator asks, the record has to come from your side.

HIPAA

HIPAA applies if you send Protected Health Information through the platform. To do that you need a signed Business Associate Agreement with FinnAI.

  • The BAA is available on the Enterprise plan only.
  • It must be signed before any PHI reaches the platform. Signing afterwards does not cover calls that already happened, and those recordings and transcripts still exist under your retention window.
  • Appointment reminders that mention only date, time, and provider generally fall under the TPO (Treatment, Payment, Operations) exception and need no separate authorization.
  • The moment the call covers diagnosis, test results, or treatment specifics, you are outside that exception and need full HIPAA handling.

The practical failure mode is scope creep in the prompt. A reminder agent that answers "so what did my bloodwork say?" has just put PHI into a transcript. Keep the script generic and use a transfer tool to route clinical questions to a human. See tools-transfer and agents-prompting.

Some states add their own disclosure requirements for AI in healthcare contexts on top of HIPAA.

GDPR

GDPR applies to EU residents regardless of where your company sits.

RequirementWhat it means for a Finn
Lawful basisReminders to existing customers usually rest on legitimate interest or performance of a contract. Cold outbound marketing needs explicit consent.
Right to deleteYou have 30 days to comply. Delete via the dashboard or the API.
Data minimizationOnly collect the post-call fields you use. Every extra extracted field is data you now have to defend and delete.
Data residencyEU customer data should stay in the EU. The account region is set at signup.

The residency choice is the one with a hard edge: it is an account-level setting made at signup, not a per-agent toggle. See data-residency.

Separately, the ePrivacy Directive governs unsolicited marketing calls in member states and is stricter than GDPR alone. Default position: do not cold-call EU consumers for marketing without prior opt-in. Soft opt-in from an existing customer relationship, with a working opt-out, is usually acceptable for similar products. Consent handling for campaigns is covered in outbound-campaigns.

SOC 2

The Finn documentation set does not yet state a SOC 2 report status, audit period, or trust services criteria scope, so this page does not claim one. If you need a SOC 2 report or a security questionnaire answered for procurement, request it through support rather than inferring status from this page.

What the platform does document today, and what you can cite in a questionnaire, is narrower: encryption in transit and at rest, configurable retention with permanent deletion at the end of the window, PII redaction for transcripts, and EU data residency.

Retention and what deletion actually deletes

Recording is on by default. You can disable it per-Finn under Call Settings, or globally under Settings → Compliance.

  • Default retention is 90 days, configurable up to 7 years for regulated industries.
  • After the window closes, recordings are permanently deleted. There is no recovery step and no support escalation that restores them.
  • A retained record includes the audio, the transcript, call metadata, and any post-call analysis fields.

PII redaction covers transcripts only. The audio is untouched. If a caller reads out a card number, redaction removes it from the transcript and leaves it in the recording. For that call you have to delete or trim the audio yourself. Details in retention and post-call-analysis.

Recording disclosure obligations, including the two-party consent states, are covered in recording-consent.