Security and data

What happens to a call recording from the moment it reaches Sillana.

Where your data lives

Sillana runs on Cloudflare. The application runs on Cloudflare Workers and the database on Cloudflare D1, with its primary copy in Eastern North America (United States). Cloudflare holds SOC 2 Type II and ISO 27001 certifications for this infrastructure.

How a call is processed

  • Your dialer sends the recording, or Sillana fetches it with the credentials you provide.
  • Speech to text runs on Cloudflare's AI platform. Scoring runs on Cloudflare's AI platform, or on Anthropic's API where enabled for your workspace.
  • By default Sillana does not keep a copy of the audio. Playback streams it from your dialer when you open a call.
  • Your call content is never used to train AI models, by us or by the AI providers we use.

Retention

Recordings, transcripts and the quotes taken from them are deleted automatically 90 days after a call is received. Scores, criterion results and reports are kept so you can follow trends, and the customer's phone number is shortened to its last four digits. You can delete any call earlier from the app, and we delete a whole workspace within 30 days of a request from its owner.

Access and isolation

  • Each workspace's data is separated and every request is checked against the signed-in user's workspace.
  • Roles control who can change scorecards, connect dialers and manage the team.
  • Passwords are stored as salted PBKDF2 hashes. Dialer credentials are encrypted with AES-GCM before they are stored.
  • All traffic is encrypted in transit with TLS, and Cloudflare encrypts stored data at rest.

Payment cards

Card payments for your subscription are handled by Stripe and never touch Sillana's servers. If your agents take card numbers over the phone, pause recording during payment as PCI DSS requires. Sillana is not designed to store card data.

Providers we use

  • Cloudflare: hosting, database, speech to text, AI scoring, email.
  • Anthropic: AI scoring, only where enabled.
  • Stripe: subscription billing. No call content.

HIPAA and health information

We do not sign BAAs yet. Do not send protected health information until a BAA is in place. Sillana is not offered as a HIPAA covered service today. If your calls include patient or member health details, write to hello@sillana.com before you connect a dialer.

Industry rules

Sillana checks each call against the scorecard you write, so it can cover the wording and steps that rules like the TCPA, the FDCPA and Regulation F, and the CMS marketing rules for Medicare require on a call. It supports your compliance team and is not legal advice.

GDPR and data processing agreements

Placeholder for the owner to confirm before launch. Proposed text: "For call content, Sillana acts as a processor on your instructions under GDPR and UK GDPR. A data processing agreement, including the EU Standard Contractual Clauses for transfers, is available on request." Confirm what you can sign, then replace this box in src/pages.js with the final text. This box never shows on sillana.com.

Certifications

Sillana does not hold its own SOC 2 report yet. We are glad to fill in your security questionnaire and sign a data processing agreement.

Report a problem

If you find a security issue, write to hello@sillana.com. We reply within two working days.