TRUST CENTRE · LAST REVIEWED 2026
Built for regulated environments.
Quallix runs in production across India, the Gulf and Europe, so every deployment is scoped to the residency, consent and conduct rules of the region it serves.
This page is maintained by AnalyticsM (Aashiva Analytics Private Limited) to answer common security and privacy questions about Quallix. It describes our own practices; it is not an independent certification.
REGION · FRAMEWORK · STATUS
Compliance matrix
Status is stated as it is today, not as we hope it will read next quarter.
| Region | Framework | What it means for you | Our status |
|---|---|---|---|
| India | DPDP Act 2023 | Consent capture before processing, in-region storage. | Aligned |
| India | RBI fair-practice code | Recovery-call conduct rules encoded in the default scorecard. | Aligned |
| EU | GDPR | Lawful basis, data subject rights, EU hosting option. | Aligned |
| UAE | PDPL | In-region hosting for Gulf deployments. | Available on Enterprise |
| Global | SOC 2 Type II | Independent controls audit. | In progress |
DATA HANDLING
What happens to a conversation once we hold it.
ENCRYPTION
TLS 1.3 in transit, AES-256 at rest
Every call recording, transcript and derived score is encrypted on the wire and on disk, with per-tenant key isolation.
ACCESS
Role-based access, logged reads
Dashboards, exports and transcripts are scoped to the team that owns them. Every read and download is written to an immutable audit log.
REDACTION
PII redacted in transcripts
Account numbers, addresses and identifiers are redacted before the transcript is stored, not after.
RETENTION
Configurable windows per client and per region
Retention is set per client, per product and per region, with hard deletion on expiry and on request.
Stated plainly
No customer data is used to train models.
Your calls, transcripts and scores are processed to serve your deployment only. They are never pooled into training sets, never used to improve a shared model, and never shared with another client.
SUB-PROCESSORS
Who else touches the data.
| Name | Purpose | Region |
|---|---|---|
| Amazon Web Services (AWS) | Compute, storage and managed database for the Quallix platform | India · EU · UAE · Singapore |
| Twilio | Inbound and outbound call transport (telephony / CPaaS) for Quallix Assist | Per deployment region |
| Deepgram | Speech-to-text transcription for call audio where a customer opts into a hosted model | In-region processing |
| Google Cloud Platform (GCP) | Secondary compute and AI/ML infrastructure | India · EU · Singapore |
| SendGrid (Twilio) | Transactional email: product notifications, digests and export links | EU |
The named list, with entity details and DPAs, is issued under the security pack once verified.
DATA RESIDENCY
Four regions. Your choice.
A deployment is pinned to one region. Recordings, transcripts and derived data do not leave it.
India
Primary region · DPDP-aligned storage
EU
Frankfurt · GDPR hosting option
UAE
Enterprise · Gulf deployments
Singapore
APAC latency and failover
SECURITY PACK
Request our security pack.
Architecture overview, data-flow diagram, retention defaults, verified sub-processor list and our standard DPA. Sent by a person, not an autoresponder.
Reporting a vulnerability? Write to security@analyticsm.com. Anything else: talk to our team.