​

Security at RevDesk

RevDesk runs revenue conversations for regulated and high-trust businesses. The platform is built on encryption-everywhere defaults, named sub-processors with executed agreements, scoped access controls, and a documented audit trail. This page is the public reference. The detailed packet is available under NDA via sales.

​

Encryption

​

Access controls

• SSO and SAML on Enterprise. Users are provisioned into the organization on first successful SSO login. RevDesk does not offer SCIM or IdP directory sync, so deprovisioning is performed in RevDesk or by revoking access at the IdP.
• Row-level scoping. Every API query runs through an ownership filter scoped to the authenticated principal’s org and team visibility. Cross-tenant reads are not architecturally reachable.
• Audit log on every mutation. Recorded via tRPC middleware. Exportable on request.
• Outreach disclosure attestation. Every outbound call and SMS persists whether a recording disclosure or STOP-instructions phrase was attached at send time, plus a two-party-consent state flag for calls. Exportable via the Compliance Center on the Outreach page. See Outreach audit.
• Sub-entity isolation for multi-tenant operators. See Sub-entities.

​

Sub-processors

The authoritative, versioned list — every sub-processor, what each receives, and where it processes — is published at revdesk.com/subprocessors and is incorporated into Annex III of your DPA. We give 30 days’ notice before a new sub-processor begins processing, with a right to object. Highlights:

​

Media path

Voice agents run as containers on the LiveKit stack, and where that stack runs differs by call direction. It is worth understanding, because it determines which parties touch call audio. Ordinary calls in both directions therefore stay on carrier-operated infrastructure: the media never transits a third-party real-time cloud, which removes a hop and a party from the path. LiveKit Cloud enters only when a browser has to share the session with a phone leg, which is inherent to that feature rather than a routing choice. This page and the sub-processor list are updated if that changes.

​

Data residency

US default. Recordings, transcripts, and call metadata are stored in US regions. EU residency is available on Enterprise on a customer-by-customer basis. Talk to sales if your contract requires a specific region.

​

Retention

An automated retention job purges expired audio and transcripts and writes an entry to the data-deletion audit log for every run. Customer-initiated deletion is supported in-app and via the API, and removes the record along with its content. On account closure, deletion completes within 90 days, matching the DPA. Stored files (recordings, voicemail audio, uploads) are removed from object storage at the point of deletion. Deleted database rows remain recoverable only within our managed Postgres change-history window, which is measured in days and never exceeds 30; past that the history is discarded permanently. That history is not restored into production to recover deleted customer data.

​

Network controls

• IP allowlisting on the API for Enterprise.
• Branded calling at the carrier level with STIR/SHAKEN attestation. See Caller trust.
• DNC scrubbing and TCPA-aware sequencing run before every campaign dial leaves the platform: federal and org-level DNC lists, per-channel consent state, calling-window enforcement, and frequency caps are all evaluated per contact at dial time. Manually initiated dials from the dialer are not gated by campaign compliance rules, so the operator is responsible for them.

​

SOC 2

SOC 2 Type II audit is in progress. Controls are mapped, evidence collection is underway, and the report will be available under NDA via sales when issued. Until then, the security packet covers the same control families and includes a gap analysis prepared by our auditors.

​

HIPAA

PHI handling is gated by a per-workspace hipaa_enabled flag that activates only after you sign a BAA with RevDesk. The flag restricts LLM routing to BAA-covered providers (an ineligible selection is swapped to a covered default), routes Gemini through Vertex AI under the Google Cloud BAA, scopes Anthropic out of the workspace entirely, limits integrations to those cleared for PHI, locks the recording disclosure on, caps recording retention at 30 days across the workspace’s numbers, and emits a compliance audit log. HIPAA mode is a compliance boundary, not a storage switch. It guarantees every provider touching call content is BAA-covered and tightens the retention default; whether call content is recorded and retained at all remains the workspace’s own decision via its recording and transcript settings. See HIPAA and BAA coverage for the full posture and how to request a BAA.

​

Incident response

Customers are notified without undue delay, and in any event within 72 hours, of a confirmed material incident affecting data we process on their behalf — the commitment in § 7 of the DPA. Under HIPAA, affected covered entities are notified within 60 days of discovery per § 164.410. Where we are the controller, supervisory authorities are notified within 72 hours per GDPR Article 33. Post-incident reports include root cause, remediation, and prevention measures. For unconfirmed events, the customer security contact on file is notified during the investigation, not after.

​

Reach security

• General security questions: security@revdesk.com
• Compliance and BAAs: compliance@revdesk.com
• Vulnerability disclosure: security@revdesk.com (PGP key in the packet)