The short version
How your data moves
Calls pulled by read-only API from your recording platform, or exported securely by your team.
Audio transcribed in the EU, with model improvement contractually disabled.
Transcripts analysed in London, in our own cloud account. Inputs and outputs stay in region.
Findings delivered. Recordings and transcripts deleted within 30 days, or sooner on your instruction.
Subprocessors
Two subprocessors touch call data. The named list forms part of our Data Processing Agreement, and we tell clients in advance of any change.
| Subprocessor | Purpose | Data | Location |
|---|---|---|---|
| Cloud hosting and analysis | Hosting, storage and analysis | Recordings, transcripts, derived analysis | London, UK |
| Transcription | Speech-to-text of call audio | Call audio and transcripts | EU |
AI model providers are deliberately absent from this list. Analysis runs inside our own cloud account, and model providers have no access to prompts, outputs or logs. The model comes to your data; your data doesn't go to the model provider.
What we will not do
These are commitments in our DPA, not marketing claims.
- Train AI on your data. Model improvement is contractually disabled with our transcription provider, and analysis inputs and outputs train nothing.
- Let model providers see your calls. They have no access to our account.
- Sell or share personal data. The two subprocessors above are the only third parties involved.
- Put customer names in reports. Every finding is referenced by call and timestamp, so your team can listen and check it themselves.
- Take write access to your systems. Retrieval is read-only. Nothing for your IT team to build.
- Keep call data after the work is done. Thirty days after each report, it's gone.
International transfers
All storage and analysis takes place in London, United Kingdom. Call audio is transcribed in the EU; transfers from the UK to the European Economic Area are permitted under UK adequacy regulations. Where any other processing takes place outside the UK, we rely on UK adequacy regulations or appropriate safeguards such as the UK International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses.
Retention and deletion
Recordings and transcripts are permanently deleted within 30 days of each report, or sooner on your written instruction. The scores we derive (ratios and counts against each adviser) are kept for as long as we work together and twelve months afterwards, so you can see whether behaviour actually changed. No recordings, no transcripts, no customer data. Reports are yours, held by you as controller of your own records. Website enquiry data is held separately and never combined with call data.
Contractual position
For call data, you are the data controller and Cognifai is the data processor. We process recordings only on your documented instructions, under a Data Processing Agreement signed before any data is shared. An NDA is signed before that, at the first conversation.
Where recordings contain special category data, most often health information mentioned on a call, you remain responsible for the controller-side lawful basis. Our processing is limited to the analysis you instruct, under the safeguards on this page.
Company and registrations
Need it in your format?
If your risk team has its own supplier questionnaire, send it to info@cognifai.uk and we'll return it within two working days.