Rubic operates inside banking, financial services and enterprise environments, which means the security review comes before the sales conversation. Everything on this page is answerable on day one, in writing, and evidenced on request.
Across the platform and the AI layer, Rubic operates to internationally recognised information security and privacy standards. Certificates and reports are available under NDA.
ISO
27001:2022
Information security management
ISO
9001:2015
Quality management systems
AICPA
SOC2
Type II
AICPA service organisation controls
TRAI
Registered telemarketer, header and template compliant
INDIA
DATA
Data stored and processed within India
All data — call records, recordings, transcripts, documents and workflow state — is stored and processed within India. Nothing leaves the country, including for AI inference. Rubic uses Voxket models for the AI layer, running on India-hosted infrastructure.
Sensitive customer data is processed only for the operational purposes agreed in your contract. No secondary use. No analytics for our own purposes. No training of models on your data, at any layer of the stack.
You retain ownership and control of your data throughout. PII is stored only with your explicit permission, and returned or deleted on request within a defined period.
Every party in the chain is disclosed before contract and named in the DPA. If we add one, you're notified in advance with a right to object.
Retention is a contract term, not a default. You set the window; the system enforces it without anyone having to remember.
| Data type | Retention |
|---|---|
| Call recordings | To your contracted schedule, then purged automatically |
| Transcripts and call metadata | A window you define — commonly 7 to 30 days for retries and quality review. |
| Documents and media | Written to your storage where you prefer; otherwise held to your schedule and purged on expiry |
| Workflow state | Account reference, status, attempt count and next action — retained while the workflow is active, purged on closure |
| Quality scores and QA evidence | To your contracted schedule, with the underlying audio purged on the same clock |
Role-based access control on the principle of least privilege
Encryption in transit and at rest
Documented business continuity and disaster recovery plans
Calling windows enforced at the dialer, configured to your policy
Registered telemarketer status, with DLT header and template registration maintained
Preference and do-not-disturb scrubbing against the list you provide
Per-account attempt trail, complete including unanswered attempts, exportable on demand
Consent for the contacts on a list remains yours as the data fiduciary. We execute against the list you provide and warrant our handling of it.
You contract with Voixa Pvt Ltd, operating as Rubic Solution — one master services agreement, one data processing addendum, one invoice, one support line, one set of service levels. Where a component of the stack is operated by a partner, that partner is named as a sub-processor in the DPA and the delivery obligation still sits with us.
One accountable party
Data fiduciary — you own the data, the customer relationship and the consent
Data processor — we act on your documented instructions and nothing else
Within the window set in your DPA, with a documented incident response and escalation path
Annual audit right on 30 days' notice, or acceptance of our current assurance reports in lieu. Immediate audit right following a material incident.
Capped by contract, with a separate provision for data incidents. Cyber liability insurance in place and evidenced on request.
Data residency, retention, sub-processors, controls and contracting are documented on request.
