Security overview

Legal entity: {{LEGAL_NAME}}, registered in India, CIN/LLPIN {{CIN}}, registered office {{REGISTERED_ADDRESS}}. Trading as EstateEngine. Contact: sam@getestateengine.com.

EstateEngine Voice is built on the principle that compliance and security are enforced in code and infrastructure, not in policy documents. This page describes the technical and organisational controls in place to protect Customer and Call Subject data.

EstateEngine Voice is multi-tenant and provider-agnostic. Every table is workspace scoped by org_id with row-level security. The service-role client is restricted to server-only paths. The voice provider is a swappable interface behind lib/voice; Retell today, Vapi or ElevenLabs if the deployment requires it.

In transit: All connections to the Service use TLS 1.2 or higher. HTTP is redirected to HTTPS. Webhook signatures are verified on the raw request body before any processing.

At rest: Database storage, backups, and object storage are encrypted at rest using AES-256 through our managed database provider (Supabase). Secrets and credentials are stored in the deployment platform's encrypted environment configuration; secrets are never written to source control.

• Row-level security (RLS): Every application table is scoped by org_id. User-context queries can only see the workspace the user is a member of.
• Service-role isolation: The Postgres service-role client is confined to server-only paths (job endpoints, webhook handlers, admin routes) and is protected by a compile-time server-only guard.
• Role-based access: Admin, manager, specialist, and viewer roles restrict UI and API surface area to the least privilege needed.
• MFA: Multi-factor authentication is required for all administrative access to platform, provider, and cloud consoles.
• Audit log: Every state-changing action (launch, pause, suppression, export, deployment) is written to an append-only audit log.

The Service runs on a small number of managed cloud providers. Compute and data storage are decoupled from voice media, which is handled directly by our voice provider.

A full list of sub-processors, purposes, hosting regions, and transfer mechanisms is maintained in the Data Processing Agreement.

EstateEngine Voice is designed to help Customers meet obligations under UAE Cabinet Resolution 56/2024 (TDRA telemarketing rules), RERA circulars applicable to brokerages in Dubai, and PDPL data protection requirements. Specific controls, including the calling window, per-owner cadence, suppression, whitelist, DNCR check, recording notice, and AI honesty response, are enforced in the database and compiler and are backed by unit tests.

SOC 2 Type II: Planned. EstateEngine is in the early stages of preparing for a SOC 2 Type II audit. Customers with formal certification requirements are invited to discuss timelines directly.

ISO 27001: Not currently certified. Our managed infrastructure providers (Vercel, Supabase, Retell, Sentry) hold their own SOC 2 and, in most cases, ISO 27001 attestations.

We maintain a documented incident response process covering detection, triage, containment, remediation, and post-incident review. Application errors are surfaced through Sentry with alerting to on-call engineers. In the event of a Personal Data Breach affecting Customer data, we will notify affected Customers without undue delay and in any event within seventy-two (72) hours in accordance with the Data Processing Agreement.

We welcome reports from security researchers. If you believe you have discovered a security vulnerability affecting EstateEngine Voice, please email sam@getestateengine.com with the subject line “Security report”. Please do not publicly disclose the vulnerability until we have had a reasonable opportunity to investigate and remediate. We commit to acknowledging reports within three business days.

Please do not: run automated scans against production systems, access data that does not belong to you, or attempt to degrade service for other users.

Personnel with access to production systems undergo background checks where permitted by local law, are bound by confidentiality obligations, and receive security awareness training. Access is granted on a least-privilege basis and is revoked promptly upon role change or offboarding.

The Service is deployed on globally distributed infrastructure with automated backups of the primary database. Recovery point and recovery time objectives are set at the platform level by our managed database provider; we retain the ability to restore from point-in-time backups.

Security questions, questionnaires, and disclosure reports should be sent to sam@getestateengine.com.