Security &
Data Protection

Every client gets their own environment. No shared infrastructure, no cross-tenant access — ever.

Each Iris deployment runs on a dedicated VPS instance. Your data, configurations, and call workflows are completely isolated from every other deployment on the platform.

Prefer full control? Iris can be hosted on your own server infrastructure, giving you complete ownership over where your data lives and how it's managed.

All data — at rest and in transit — is protected with enterprise-grade encryption.

• End-to-end encryption for all data at rest and in transit
• Encrypted call recordings and transcripts, stored per your policy
• No third-party data sharing — your data is never sold or used for model training
• Client-controlled retention — you decide how long records are kept

You can request permanent deletion of all interaction data at any time. Retention windows are fully configurable to match your internal compliance requirements.

Built to meet the regulatory standards that matter most to your business.

GDPRAligned

HIPAAAligned

SOC 2Ready

• GDPRAligned with EU data protection requirements. Full data subject rights support — access, portability, and erasure on request.
• SOC 2SOC 2 ready. Our controls for security, availability, and confidentiality are designed to meet Type II audit requirements.
• HIPAAOur infrastructure, access controls, and data handling practices are architected to meet HIPAA standards. Not yet formally attested, but operating with full alignment.
• Audit LogsTamper-evident activity logs across every layer — ready for compliance audits at any time.

Built for continuous, uninterrupted operation — because downtime isn't an option.

• 99.9% uptime guarantee with proactive incident response
• Real-time system health monitoring around the clock
• Auto-scaling infrastructure that handles demand spikes without intervention
• Sub-second response times maintained across all operations

Issues are detected and resolved before they affect your operations. Our team monitors system health continuously, with automated alerting and rapid escalation protocols.

Strict, layered access control at every level of the system.

• Secure authentication required for all system access
• Role-based permissions so team members only access what they need
• API connections with scoped, least-privilege permissions
• Full audit trail with detailed activity logs for every action