How Simple keeps customer data safe
Simple talks to your customers, so it protects their details on every call. Here’s how, and where your security team can check our work.
Questions? Email security@usesimple.ai
Protected on the call, and long after
Your customers’ trust is part of the sale. Here’s what Simple does with the details they share.
- Redaction in real timeCard numbers and personal details are masked in transcripts as the call happens.
- EncryptionData is encrypted at rest and in transit. Recordings and transcripts are stored with AES-256.
- Access controlMulti-factor sign-in for our applications and infrastructure, with employee access reviewed regularly.
- RetentionSensitive payment information is deleted automatically, and the rest is kept under a written data retention policy.
- 1:02Chris
Use the new card, it’s 5521 0094 3318 7702, expires 08/29.
- 1:09Simple
Thanks, Chris. And the service address is still 1840 Larkin Ave?
- 1:13Chris
Yes. And my date of birth is March 3, 1981, if you need it.
Simple works inside your systems
Simple answers on the phone system you already run and works in your own CRM and order systems. Your team decides what it can see and do.
- Your phone systemFive9, Genesys, NICE, Talkdesk, Amazon Connect, Cisco, Zoom, or any SIP carrier
- SimpleRedacts sensitive details as the call happens, and encrypts what it keeps
- Your systems of recordSalesforce, SAP, calendars, and your own order systems
Calls stay on your phone system
Point a number or a queue at Simple. When a call needs a person, it goes to your team with the whole story.
Only what the workflow needs
Before launch, we map each read, write, and sign-in step the workflow needs in your systems.
Your team sets the rules
You decide who can see what, how long data is kept, and what each workflow is allowed to do.
Security controls
The Trust Center lists every control we run. Here are the main ones, in plain words.
See every control- Access
- Multi-factor sign-in for applications, infrastructure, and admin access. Access to sensitive data needs a request, is reviewed regularly, and is removed when people leave.
- Data
- Encrypted at rest and in transit. Full card numbers are protected and hidden, and sensitive payment information is deleted automatically.
- Backups and recovery
- Automated backups, isolated recovery data, and disaster recovery plans that are tested.
- Infrastructure
- Production and test environments are separate. Infrastructure changes are reviewed and logged, behind a web application firewall.
- Monitoring
- Audit logs are collected and kept, critical systems are monitored, and incidents follow a set response and breach notification process.
- Testing
- Penetration testing within the last 12 months, regular vulnerability scans, and automatic software patching.
- People
- Background and reference checks for employees, a named security official, and a code of conduct.
- Vendors
- Every vendor is classified by risk and by the data it handles. Our subprocessors are listed in the Trust Center.
Policies for your review
Our security policies are available on request. Ask for them in the Trust Center, and we’ll share them with your team.
Or email security@usesimple.ai
Questions from security teams
Is Simple SOC 2 compliant?
Yes. Simple is SOC 2 Type 2 compliant, which means an independent auditor tests that our security controls work over time, not just on one day. You can see the controls in the Trust Center.
Is Simple HIPAA compliant?
Yes. Simple is HIPAA compliant, so it’s ready for conversations that involve health information.
What happens to card numbers on a call?
Simple masks them in transcripts as the call happens, so full card numbers stay protected and hidden. Sensitive payment information is deleted automatically.
Which other companies process our data?
Our subprocessors, and what each one does, are listed in the Trust Center. Amazon Web Services is our primary cloud provider.
How do we report a security issue?
Email security@usesimple.ai with as much detail as you can, and our team will follow up.
Everything your security team needs
Our compliance status, controls, policies, and subprocessors, all in one place.