Trillet Security and Compliance Overview (Evergreen Reference)

TL;DR

Trillet holds SOC 2 Type II and ISO 27001 certifications and provides controls that support regulated workflows. HIPAA-regulated processing requires Agency or Enterprise, an executed BAA, and an applicable Order Form; Studio is not authorised for PHI. GDPR-covered processing requires the applicable DPA and transfer mechanism. TCPA, ACMA, and DNCR obligations remain shared with the customer. This reference explains the evidence, contract paths, and claims agencies should qualify.

For agencies selling voice AI to regulated industries (healthcare, legal, financial services), compliance is not a nice-to-have feature. It is the entry ticket. An agency that cannot demonstrate its platform's compliance posture will lose the deal to one that can.

HIPAA Compliance

HIPAA (Health Insurance Portability and Accountability Act) governs the handling of Protected Health Information (PHI) in the United States. Any voice AI system that processes calls for healthcare providers, insurers, or their business associates must comply with HIPAA's Privacy Rule, Security Rule, and Breach Notification Rule.

For an authorised HIPAA workflow, Trillet requires Agency or Enterprise plus an executed BAA and applicable Order Form. Security controls support that scoped deployment; they do not make every account or workflow HIPAA compliant. This means:

Per-agent control: Studio, Agency, and Enterprise include a HIPAA mode toggle that disables recording and post-call storage of call content on Trillet's servers. The switch itself does not require a BAA, but only Agency and Enterprise offer the BAA pathway for live PHI, which requires a signed BAA and covered Order Form. Verify connected systems and subprocessors separately.
Business Associate Agreement (BAA): Trillet executes BAAs with agencies, and agencies can extend coverage to their healthcare clients.
PHI encryption: All call data containing PHI is encrypted at rest (AES-256) and in transit (TLS 1.2+).
Access controls: Role-based access ensures only authorized users can access PHI.
Audit logging: All access to PHI is logged for compliance audits.
Breach notification: Trillet's incident response process includes the notification timelines HIPAA requires.

By comparison, several platforms treat HIPAA as a paid add-on rather than a standard inclusion (ChatDash, for example, charges an extra $200/month for it), so agencies either absorb that cost or pass it to their clients. For agencies targeting medical practices, dental offices, or therapy practices, a platform without included HIPAA compliance means either absorbing that cost or losing the vertical entirely.

What to tell clients: "For an approved Agency or Enterprise workflow, Trillet can execute a BAA and applicable Order Form. We will confirm the data flow, controls, retention, and each party's responsibilities before PHI is processed."

SOC 2 Type II Certification

SOC 2 Type II is an audit standard developed by the American Institute of CPAs (AICPA) that evaluates a service organization's controls related to security, availability, processing integrity, confidentiality, and privacy. Unlike SOC 2 Type I (a point-in-time snapshot), Type II requires sustained compliance over a 6 to 12 month observation period by an independent auditor.

Trillet holds SOC 2 Type II certification. For agencies, this means:

Independent verification: A third-party auditor has confirmed that Trillet's security controls operate effectively over an extended period, not just on a single day.
Scope coverage: The certification covers the voice AI processing pipeline, including call routing, transcription, recording storage, and API access.
Client confidence: Financial services, legal, and enterprise clients routinely require SOC 2 Type II reports from their vendors.

As Telnyx notes in its 2026 SOC 2 vendor checklist, voice AI runs across live PSTN calls, real-time media, recordings, transcripts, LLM inference, and integrations, and not every vendor's SOC 2 scope covers all of those layers. Agencies should verify that their platform's SOC 2 scope covers the complete call path, not just the dashboard or API layer.

What to tell clients: "Our platform holds SOC 2 Type II certification, meaning an independent auditor has verified our security controls over a sustained period. We can provide the report on request for your compliance review."

GDPR (General Data Protection Regulation) applies to any organization processing personal data of EU residents, regardless of where the organization is based. For voice AI, this covers caller phone numbers, names, conversation content, call recordings, and transcripts.

Trillet's GDPR compliance includes:

Lawful basis for processing: Trillet processes data as a processor on behalf of the agency (controller), documented through a Data Processing Agreement.
Data subject rights: Support for access requests, deletion requests, and data portability under Articles 15 through 20.
Data minimization: Only data necessary for the service is collected and processed.
Encryption: All personal data is encrypted at rest and in transit.

For agencies serving EU clients, platform controls support the processor role, but the agency and client retain their controller or processor obligations. Current terms require the applicable DPA and transfer mechanism before covered processing.

What to tell clients: "We will execute the applicable DPA and transfer mechanism, document roles and data flows, and configure retention and rights-request handling for the engagement."

TCPA and Outbound Calling Compliance

The Telephone Consumer Protection Act (TCPA) regulates outbound calls, texts, and faxes in the United States. Violations carry penalties of $500 to $1,500 per call, making non-compliance extremely expensive at scale. For agencies reselling outbound voice AI, TCPA compliance is non-negotiable.

Trillet's TCPA compliance includes:

Do Not Call (DNC) list filtering: Outbound campaigns are automatically screened against the National DNC Registry.
Consent management: Tools for documenting and verifying prior express consent before outbound calls.
Time-of-day restrictions: Outbound calls are restricted to permitted calling hours based on the recipient's time zone.
Honeypot detection: Trillet can identify, avoid, or flag trap systems that waste outbound usage. It is an operational safeguard, not a substitute for lawful consent, suppression, and calling procedures.
Number masking: Outbound caller ID can be configured to comply with FCC disclosure requirements.

What to tell clients: "The platform provides calling controls and DNC-oriented safeguards, while our campaign process still requires lawful consent, notices, suppression, calling windows, configuration, and supervision."

ACMA and DNCR (Australia)

The Australian Communications and Media Authority (ACMA) regulates telecommunications in Australia, and the Do Not Call Register (DNCR) is Australia's equivalent of the US National DNC Registry. Any agency deploying voice AI for Australian clients must comply with both.

Trillet is Australian-headquartered and provides ACMA- and DNCR-oriented calling controls. These controls support an agency's program, but lawful outreach, consent, suppression, notices, configuration, and supervision remain shared responsibilities. Relevant features include:

DNCR screening: Outbound campaigns are automatically checked against the Australian DNCR.
Telemarketing rules: ACMA rules on calling hours, identification, and consent still apply to every campaign, so configure and document them for each client.
Spam Act obligations: SMS follow-up messages still need consent, sender identification, and an unsubscribe path under Australia's Spam Act 2003.

For agencies serving Australian markets, an Australian-built platform with DNCR screening reduces the risk of relying on a US-based vendor that treats Australian regulations as an afterthought.

What to tell clients: "Our platform is Australian-built and screens outbound campaigns against the Do Not Call Register. We still run every campaign with the consent, calling-window and suppression rules Australian telemarketing law requires."

ISO 27001 Certification

ISO 27001 is the international standard for information security management systems (ISMS). It provides a framework for managing risks to the security of information, including policies, procedures, and technical controls. Trillet holds ISO 27001 certification, which covers:

Risk management: Systematic identification and treatment of information security risks.
Access control policies: Documented procedures for granting, reviewing, and revoking access to systems and data.
Incident management: Defined processes for detecting, reporting, and responding to security incidents.
Supplier management: Security requirements for third-party providers are documented and monitored.

ISO 27001 is increasingly required by enterprise and government clients, particularly in Australia where IRAP assessments reference ISM (Information Security Manual) controls that align closely with ISO 27001. For agencies targeting enterprise clients through the white-label platform, the ability to point to ISO 27001 certification adds credibility in procurement conversations.

What to tell clients: "Our platform is ISO 27001 certified, meaning we operate a formal information security management system that is independently audited. This covers risk management, access controls, incident response, and supplier security."

Data Encryption and Storage

Trillet encrypts all data at rest and in transit across every plan. The specifics:

In transit: TLS 1.2+ encryption for all API calls, dashboard access, and data transfers between services.
At rest: AES-256 encryption for stored call recordings, transcripts, and client data.
Call recordings: Where recording is enabled, recordings are stored with role-based access controls and can be accessed through the dashboard or API, subject to the applicable settings and permissions. HIPAA mode on Studio, Agency, and Enterprise disables recording and post-call storage of call content on Trillet's servers for the selected agent.
Transcripts and summaries: Where generated and retained outside HIPAA mode, these are subject to the applicable encryption and access controls. HIPAA mode does not retain the agent's call content on Trillet's servers after the call ends.

For agencies, the practical implication is that data must be protected in transit and, where retained, at rest. Encryption supports security obligations, but does not by itself make a deployment compliant with HIPAA, GDPR, SOC 2, or APRA CPS 234.

PII Handling and Data Retention

Voice AI systems inherently process personally identifiable information (PII): caller phone numbers, names, addresses, and in healthcare contexts, protected health information (PHI). How a platform handles PII determines whether it can serve regulated industries.

Trillet's PII handling includes:

Configurable retention: Agencies can set data retention periods based on their clients' regulatory requirements.
Data deletion: Support for deletion requests under GDPR, CCPA, and other privacy frameworks.
Access controls: Role-based permissions ensure only authorized users see PII.
Audit trails: All access to PII is logged, supporting compliance audits and investigations.

Studio, Agency, and Enterprise include a HIPAA mode switch for each agent. Enabling it stops call recording and post-call storage of call content on Trillet's servers for that agent; it does not require a BAA just to turn the switch on or test with non-PHI data. Studio does not offer the BAA pathway. Before routing live patient information on Agency or Enterprise, execute a BAA and Order Form covering that workflow. Confirm what connected systems and subprocessors receive or retain, and do not assume the switch performs redaction or eliminates all operational metadata. Enterprise can separately scope broader end-to-end no-storage architecture, residency, and private-deployment requirements where the agreement includes them.

What to tell clients: "We handle caller data with configurable retention policies, role-based access controls, and full audit logging. Data deletion requests are supported for GDPR and CCPA compliance. All PII is encrypted at rest and in transit."

What Agencies Can Tell Their Clients

Agencies reselling Trillet's voice AI platform under their own brand can make the following factual claims about security and compliance to their clients:

Claim	Supported By
HIPAA path on eligible deployments	Agency or Enterprise, executed BAA and applicable Order Form
Per-agent HIPAA mode	Available on Studio, Agency, and Enterprise; enabling it disables recording and post-call call-content storage on Trillet's servers, but does not itself authorize live PHI processing
SOC 2 Type II certified	Independent third-party audit report
GDPR processing path	Applicable DPA, transfer mechanism, documented roles and controls
Calling-compliance controls	DNC-oriented screening and honeypot detection; customer duties remain
ACMA and DNCR compliant	Australian-built, automated DNCR screening
ISO 27001 certified	Independent ISMS audit
Data encrypted at rest and in transit	AES-256 at rest, TLS 1.2+ in transit
Configurable data retention	Agency-controlled retention settings

Agencies should avoid making claims beyond the configured and signed scope. Studio, Agency, and Enterprise include the per-agent HIPAA mode control described above: no recording or post-call call-content storage on Trillet's servers. That does not establish redaction, no retention by connected systems or subprocessors, permission for Studio to process PHI, or Enterprise-only commitments such as dedicated infrastructure and contractual residency. Be precise about which data path and settings the client will receive.

For agencies that want to build compliance into their sales process, having a one-page security summary that maps these certifications to client concerns (healthcare = HIPAA, financial = SOC 2 + GLBA, Australian = ACMA + APRA CPS 234) is the most effective sales tool. For the wider context on building and reselling a compliant voice AI business, see the white-label voice AI guide, and for a platform-by-platform comparison of which vendors include compliance, see white-label AI with built-in compliance.

Frequently Asked Questions

Does Trillet charge extra for HIPAA compliance?

Trillet does not charge an incremental BAA fee, but PHI processing is limited to Agency or Enterprise after its standard BAA and Order Form process. Studio is not authorised for PHI.

Trillet provides SOC 2 Type II reports on request to agencies and their clients for compliance review purposes. The report covers the complete voice AI processing pipeline, not just a single layer.

What encryption does Trillet use?

All data is encrypted at rest using AES-256 and in transit using TLS 1.2+. This applies to call recordings, transcripts, client data, and API communications across all plan tiers.

Is Trillet compliant for Australian financial services clients?

APRA, IRAP, residency, penetration-testing, and deployment-boundary commitments are engagement-specific. Australian calling and privacy obligations still require customer procedures and the applicable agreement.

What is the difference between white-label and Enterprise compliance features?

SOC 2 Type II and ISO 27001 apply to Trillet's security posture. Studio, Agency, and Enterprise include a per-agent HIPAA mode toggle that disables recording and post-call storage of call content on Trillet's servers. Only Agency and Enterprise offer the BAA pathway, and a HIPAA-covered workflow still needs the executed BAA and covered Order Form before live PHI is processed. GDPR-covered processing requires the applicable DPA and transfer mechanism. Enterprise can add contract-specific residency, deployment, SSO/RBAC, dedicated infrastructure, and SLA options.

Resell Compliant Voice AI Under Your Brand

Trillet provides a certified security foundation plus scoped contract paths and enterprise controls for regulated work. The agency and client still own lawful use, configuration, notices, consent, outreach rules, and supervision. See the Trillet white-label platform, compare pricing, and read the white-label voice AI guide.

Updated for September 2026: corrected HIPAA plan authorisation, GDPR agreement requirements, shared calling-law responsibility, and engagement-specific enterprise controls. Also replaced the blanket ACMA compliance claim with an accurate DNCR screening statement.