Trust
Trust Center
Finn runs regulated calls and conversations at scale — AI voice agents, chat AI agents on WhatsApp, SMS, email and website chat, and a parallel dialer for sales teams — in healthcare, finance and insurance. A SOC 2 Type II attestation from an independent auditor covers all of them, and our AI voice agents run within an ISO/IEC 27001:2022-certified information security management system, with service management and quality systems certified alongside.
Last updated: October 11, 2026
Policies & agreements
Documentation
Legal
Privacy Policy
What we collect, why, and how it's used.
Communication Terms
How we contact people by phone, SMS, WhatsApp, chat and email: opt-in, STOP and HELP, calling hours, and opting out.
Terms of Service
The agreement governing use of Finn.
Data Processing Addendum
Our contractual data-protection commitments.
Refund & Cancellation Policy
Eligibility, request process, and timelines.
Data & AI
Subprocessors
The third parties that process data on our behalf, with per-region processing locations.
Data-flow map
How call and audience data moves through our subprocessors.
AI data use & retention
No training on your data, zero data retention on Enterprise, and deletion timelines.
Security & compliance
Security posture
How Finn protects data: encryption, access control, data residency and our compliance frameworks.
Vulnerability Disclosure Policy
How to report a security issue — scope, safe harbor, and our response.
Consent & Legal Guidance
Consent and channel rules for calls, WhatsApp, SMS, email, website chat and the Rep Parallel Dialer.
Certifications & audits
Certifications
Held
SOC 2 Type II
AICPA Trust Services Criteria
- Status
- Attested
- Audited by
- Independent auditor
- Report
- Under NDA
ISO/IEC 27001:2022
Information Security Management
- Certificate
- UKBIZ/25D/ISMS/0062
- Issued
- 19 May 2025
- Valid through
- 18 May 2028
ISO/IEC 20000-1:2018
IT Service Management
- Certificate
- UKBIZ/25G/ITMS/0061
- Issued
- 19 May 2025
- Valid through
- 18 May 2028
ISO 9001:2015
Quality Management
- Certificate
- UKBIZ/25K/QMS/0060
- Issued
- 19 May 2025
- Valid through
- 18 May 2028
ISO certified scope: Real-time AI voice agents that handle outbound and inbound calls, automating conversations, bookings, and support with natural, human-like speech and system integrations. The SOC 2 Type II attestation covers all Finn services, including chat AI agents and the Rep Parallel Dialer.
Available on request
HIPAA Business Associate Agreement
For enterprise customers processing PHI. Executed per engagement.
Standard Contractual Clauses
Executed copy with completed annexes for EU, UK, and Swiss transfers.
ISO 27001 Statement of Applicability
Annex A control detail, shared under NDA.
Email [email protected] to request any of these, the SOC 2 report, or a copy of a certificate.
Security & data protection
Compliance is the floor, not the ceiling.
Calls and messages are regulated. Healthcare, finance, insurance, legal — Finn was built to run there from day one.
A certified information security management system
Rather than ask you to take our word for it, we point at the audit. Our ISMS is certified to ISO/IEC 27001:2022 for the scope above — the standard whose Annex A controls cover access control, cryptography, operations security, logging and monitoring, supplier relationships, and incident management. Certification was assessed by an independent, EUAS-accredited body and is maintained through annual surveillance audits.
Customers under NDA can request our Statement of Applicability and control detail through their account team.
Data residency
Your workspace's storage region is selected at provisioning — United States, India, Singapore, UAE, United Kingdom, or Germany (EU) — and call recordings, transcripts and conversations come to rest there. Regional separation falls within the scope of our ISO/IEC 27001 certification.
For the region assigned to your workspace, or a written residency attestation for a vendor review, contact [email protected].
Encryption in transit and at rest
AES-256 at rest, TLS 1.2/1.3 in transit. Recordings, transcripts, chat messages and PII are all encrypted by default.
Tenant isolation
Every workspace's data is logically segregated — one customer can never query, call, or access another's data, agents or conversations.
PII redaction
Per-deployment redaction toggle for call transcripts — defense in depth alongside our DPA's instruction not to collect card numbers or government IDs in calls or chats.
Access control
Granular permissions per user, per workspace. Production access restricted to authorized personnel via MFA and SSH keys, on least privilege.
AI models, speech and messaging services run on additional providers — see Subprocessors for the full list and per-workspace-region processing views.
Beyond the certifications
Regulatory posture
The platform is built and operated around the regimes below. These are obligations we design for — distinct from the independently audited certifications above.
GDPR / ePrivacy
European Union & EEA
DPDP Act 2023
India
HIPAA
United States — BAAs available for PHI workloads
TRAI & RBI
India — telecom and financial communication
TCPA / FTC TSR
United States — telemarketing
CTIA / 10DLC
United States — business SMS
CAN-SPAM
United States — commercial email
Meta WhatsApp policies
WhatsApp Business Platform
Responsibility for consent, the intent of each call and message, and audience sourcing sits with the customer. Our Consent & Legal Guidance sets out what that means in each region.
Reliability
System status
All systems operational
Monitored externally since 18 Jul 2026 · updated live
99.68%
Uptime · last 90 days
Get in touch
Security contact
Report a security concern
If you believe you've found a vulnerability, email [email protected] with steps to reproduce, affected endpoints, and any supporting detail. We investigate every report and respond directly. We ask that you allow up to 90 days from your report before any public disclosure — we’ll coordinate timing with you.
Security review or vendor onboarding
For security questionnaires, DPAs, company registration details, or documentation not published here, contact [email protected].
AIforge Tech Private Limited · CIN U62099RJ2025PTC099494 · Jaipur, Rajasthan, India