AI Voice Agent Security: What to Ask Before You Hand Over Your Calls

Putting an AI voice agent on your phone line hands a supplier a live feed of your customers saying their names, numbers, addresses and reasons for calling. You do not need to be technical to vet that properly. You need a fixed list of questions and the discipline to insist on written answers.

A short note on scope. This article is general information for business owners about how to evaluate a supplier, not legal advice, and your sector or member state may impose additional requirements. For a specific deployment, take advice from a qualified data protection adviser.

Why call data deserves more scrutiny than your other software

Most owners apply more diligence to their accounting software than to the system answering their phone, which is the wrong way round. A booking system holds what a customer chose to type into a structured field. A phone line holds what they said out loud, unfiltered, often before they knew what they were going to say.

Think about what actually goes down a service business phone line in a week. A patient explaining a symptom in order to justify why the appointment is urgent. A client mentioning the dispute their solicitor is handling. A homeowner giving an address, a door code, and the fact that they will be away until Thursday. None of that is data you asked for. It arrives anyway, because people explain themselves to whoever picks up.

Two properties make this category harder than ordinary business data. Voice recordings are biometric-adjacent, in that a recording of a person speaking is an identifier that is difficult to make anonymous and impossible for the person to change. And callers have no relationship with your vendor. They rang you. Every obligation they think they are owed, they are owed by you, which is why the controller position sits with your business and not with your supplier. That distinction is the backbone of the wider data protection picture we set out in our guide to GDPR and AI customer service.

The good news is that vetting this well does not require technical knowledge. It requires knowing which questions have a right answer and refusing to accept an answer that is not written down. What follows is the list we would use ourselves.

Where does the audio live, and under whose law?

Ask: in which country and region is my call audio stored, in which country is it processed, and does either ever change without notice?

These are deliberately separate questions and vendors often answer only the first. A supplier can store recordings in a Frankfurt data centre and still send every second of audio to a speech recognition service and a language model hosted elsewhere. The storage location tells you where the file sits. The processing location tells you where the conversation actually travelled. Both matter, and only one of them usually appears in the marketing material.

A good answer names a specific region rather than a company headquarters, distinguishes storage from processing, identifies which provider handles each step, and points to the clause in the data processing agreement that commits to it. If any component sits outside the EU or EEA, a good vendor volunteers that before you ask and explains which transfer safeguards apply.

A poor answer is any version of the phrase that they are a European company, offered as if corporate registration determined where packets travel. It does not. Another poor answer is the claim that they use a major cloud provider, which tells you nothing, since every major cloud offers regions on several continents.

For an EU business, keeping the whole chain inside the EU is not a legal requirement in every case, but it is the simplest defensible position, because it removes a category of questions instead of forcing you to manage it. It also makes your answer to a customer who asks where their data goes considerably shorter.

How long do you keep it, and can you really delete it?

Ask: what is the default retention period for audio and for transcripts, can I configure it, and what is the actual mechanism when a customer exercises their right to erasure?

Retention is where the gap between policy and engineering shows up most clearly. Deleting a recording from the main storage bucket is straightforward. The question is what happens to the copy in the backup taken last night, the transcript replicated into the analytics layer, the summary written into your CRM, the log line in the telephony provider's system, and the debug trace someone captured during a support ticket in March.

Notice also that audio and transcripts deserve different periods. Many businesses have no operational need for the audio at all once a transcript and a structured summary exist. Deleting the audio quickly while keeping a short transcript is often the sensible configuration, since it removes the highest-risk artefact first.

A good answer gives you a configurable default, distinguishes audio from text, describes what happens across backups and downstream systems, states a maximum time by which a deletion request fully propagates, and offers written confirmation once it has. A poor answer is a retention policy that means indefinitely by omission, or an erasure process that turns out to be a support ticket and a promise.

Is my data training your models, or anyone else's?

Ask: are my call recordings, transcripts or any data derived from them used to train, fine-tune or evaluate your models or a third party's models, and where is that written?

This is the question where a verbal answer is least acceptable, for a reason that has nothing to do with the vendor's honesty today. Terms change. Companies get acquired. A pricing tier gets restructured and a feature you relied on moves. What protects you is a clause, not a conversation.

Be specific about scope when you ask, because there is more surface area here than people expect:

• The vendor's own models. Are your conversations used to improve the product for other customers?
• Third party model providers. Most voice agents are built on models from a small number of large providers. Those providers publish enterprise and API terms that differ from their consumer terms. Ask which terms your vendor operates under.
• Human review. Some pipelines route a sample of interactions to people for quality labelling. That is a legitimate practice, but you should know whether it happens and be able to switch it off.
• Derived data. Embeddings, summaries, intent labels and quality scores are all derived from your customers' words. A clause covering only raw audio leaves a gap.

A good answer is a written commitment covering all four, flowing down to sub-processors, with a named contractual location. A poor answer is a reassurance in a sales call, or a privacy policy sentence with an exception attached to improving our services, which is broad enough to mean almost anything.

Encryption, explained without the jargon

Ask: is call data encrypted in transit and at rest, what standards do you use, and who holds the keys?

Two plain definitions, since vendors rarely offer them. In transit means the data is scrambled while it moves between systems, so anyone able to intercept the connection sees noise rather than a conversation. At rest means it is scrambled while sitting in storage, so someone who obtains a disk image or a database backup cannot simply open and read it. You want both, and any serious vendor will have both.

Because both are near-universal, the answer itself is not very discriminating. The follow-up is. Ask who holds the decryption keys, how key access is controlled, and whether keys are rotated. A vendor whose team can answer that fluently has an engineering function that thinks about security. A vendor who answers by repeating the phrase bank-grade encryption, which means nothing specific, has a marketing function that thinks about security.

Worth knowing about the limits, too. Encryption at rest protects against stolen storage. It does not protect against a compromised account with legitimate access, which is the far more common failure. That is why the next question matters more than this one.

Who at the vendor can listen to my customers?

Ask: which roles inside your company can access or play back my call recordings, what controls that access, and is it logged in a way I can review?

Almost every real-world data incident involving a service provider comes down to access rather than cryptography. Someone had a login they should not have had, or kept one after changing role, or an account without multi-factor authentication was phished. This is the least glamorous part of a security review and the most predictive.

What good looks like, in plain terms: access is limited to named roles rather than available to everyone in the company, it requires multi-factor authentication, it is granted for a reason rather than by default, it is removed when someone leaves, and it is recorded so that there is a trail showing who opened what. Some vendors go further and require an approval or a support ticket reference before a support engineer can open a customer's recording. That is a good sign.

It is also fair to ask for the boring administrative facts: whether staff are background checked, whether they are under confidentiality obligations, and whether the company holds a recognised security certification such as ISO/IEC 27001 or a SOC 2 report. A certification is not proof that a vendor is safe. It is evidence that an outside party has looked at their controls and that someone internally owns the process, which is more than most small suppliers can show.

Who else is in the chain behind you?

Ask: please send me your current sub-processor list, and tell me how I am notified when it changes.

An AI voice agent looks like one product and is almost never one company. A typical stack involves a telephony carrier moving the call, a speech-to-text service converting audio to words, a language model deciding what to say, a text-to-speech service producing the voice, a database holding transcripts, a calendar or CRM receiving the outcome, and often a monitoring or analytics tool sitting across the top. Our explainer on how AI voice agents work walks through that pipeline in detail.

Each of those is a company that touches your customers' words. Your obligations follow the data, not the invoice, so you need to know who they are. A vendor that treats this list as confidential is asking you to accept unnamed parties in your supply chain, which is not a reasonable request.

A good answer is a maintained list, published or provided on request, naming each sub-processor, what it does, and where it processes data, plus a commitment to notify you in advance of additions so you have a chance to object. A poor answer is a generic reference to industry-leading partners.

What happens to my data if I leave?

Ask: if I terminate, what can I export, in what format, how long do I have to do it, and when is everything deleted?

Every buyer evaluates onboarding and almost nobody evaluates the exit, which is why exits go badly. The leverage to negotiate this exists exactly once, before you sign.

Three things to pin down. Portability: can you export transcripts, call metadata and any structured outcomes in a usable open format such as CSV or JSON, rather than a PDF report or a screen you have to scrape. Deletion: is there a defined period after termination by which all your data, including backups, is destroyed, and will they confirm it in writing. Continuity: if the assistant handles your main business number, who controls that number and how quickly can you point it elsewhere. Number portability is a genuine lock-in risk that has nothing to do with the AI and everything to do with whether you can leave.

Clinics, law firms and other sensitive contexts

Some businesses take calls where the subject matter itself raises the stakes. A dental or aesthetic clinic hears about medical conditions. A law firm hears about disputes and finances. A veterinary practice hears about a household as much as an animal. GDPR treats health data as a special category with a higher threshold for processing, and professional confidentiality duties sit on top of that for regulated professions.

The practical response is not to avoid automation, it is to shape it. Three moves do most of the work.

Narrow the assistant's job deliberately

The most effective privacy control available to a clinic is scope. An assistant that books, reschedules, confirms, answers questions about opening hours and pricing, and hands anything clinical straight to a human never needs to hold clinical detail in the first place. Data you never collect cannot leak, cannot be over-retained and cannot be subject to an erasure request. This is the design we use for AI receptionists in clinics, and it is a security decision before it is a product decision.

Shorten retention for the highest-risk artefact

If a caller does volunteer something sensitive, and they will, the audio is the most exposing form of it. Aggressive audio deletion with a short transcript retention window reduces the blast radius of any future incident without costing you operational capability.

Get the paperwork right

A signed data processing agreement, the sub-processor list, the training exclusion clause, and a record of the assessment you did before going live. In a higher-risk context you may also need a formal data protection impact assessment. That is a question for your adviser, not for your vendor's sales team.

Recording notice and AI disclosure

These are two obligations that get muddled into one sentence and end up serving neither.

Recording notice is a data protection matter. Capturing a call captures personal data, so you need a lawful basis, a stated purpose and a notice the caller can actually understand before recording starts. Several member states apply additional national rules on call recording, so confirm the position in your own jurisdiction rather than assuming the EU-level picture is the whole story.

AI disclosure is a different obligation with a different purpose, covered by the transparency expectations in the EU AI Act. The European Commission's framing is that people should be made aware they are interacting with a machine so they can make an informed decision. We covered what that means for a small business in our guide to the EU AI Act for small businesses.

Handle them as two short, sequential statements at the start of the call, before any personal information is requested, and give the caller a way to reach a human immediately. In our experience this costs a second or two of call time and prevents the far more expensive situation where a customer works out mid-conversation that they were misled.

What happens when something goes wrong

Ask: if you suffer a security incident affecting my data, how quickly do you tell me, who tells me, and what will you tell me?

This question is not pessimism, it is arithmetic. Every supplier in your chain has a non-zero chance of an incident, and your exposure depends less on whether one happens than on how fast you find out and how much you are told.

The reason speed matters is that the regulatory obligation lands on you, not on them. Under GDPR, a personal data breach must be notified to the supervisory authority without undue delay and, where feasible, within 72 hours of becoming aware of it, where notification is required. If your vendor takes a fortnight to tell you, your clock has already run down while you were unaware there was a clock. A commitment to notify within a reasonable period is therefore not usable. You want a defined window, short enough to leave you room to act.

A good answer includes a contractual notification window, a named contact or a monitored security address, a commitment to describe what data was affected and what they are doing about it, and a willingness to support your own notification if you have to make one. A poor answer is silence on the topic in the contract, which in practice means you find out when a customer does.

The vendor security questionnaire

Send this as a document and ask for written answers. The exercise is as diagnostic as the content. A vendor who returns it in a couple of days with specifics is a different kind of company from one who offers a call to discuss it instead.

Question to ask	What a good answer looks like	Warning sign
Where is call audio stored, and in which region?	A named region, committed to in the data processing agreement.	A country of incorporation offered instead of a data location.
Where is the audio processed by speech and language models?	Named providers and regions for each processing step.	Treating storage and processing as the same question.
What is the default retention for audio and for transcripts?	Separate, configurable periods with a stated default.	No stated period, which means indefinite.
How does erasure work across backups and downstream systems?	A described mechanism, a maximum propagation time, written confirmation.	Deletion handled as an ad hoc support request.
Is my data used to train your models or a third party's?	A contractual exclusion covering raw, derived and human-reviewed data, flowing down to sub-processors.	Verbal assurance, or a policy exception for service improvement.
Is data encrypted in transit and at rest, and who holds the keys?	Named standards, described key management and rotation.	Undefined marketing terms such as bank-grade security.
Which roles can access or play back my recordings?	Role-based access, multi-factor authentication, access logging, removal on departure.	Any answer implying general staff access.
Do you hold a recognised security certification?	ISO/IEC 27001 certification or a SOC 2 report, with scope stated.	Claiming compliance with a standard without certification or scope.
Can I see your current sub-processor list?	A maintained list with roles and locations, plus advance notice of changes.	Refusal, or a reference to unnamed partners.
What can I export if I leave, and in what format?	Open formats such as CSV or JSON, covering transcripts, metadata and outcomes.	Export available only as reports, or not addressed in the contract.
When is my data deleted after termination?	A defined period including backups, confirmed in writing.	Deletion at the vendor's discretion.
How fast do you notify me of a security incident?	A contractual window, a named contact, defined content of the notice.	No incident clause, or a commitment to act reasonably.
Who controls my phone number, and how fast can I move it?	You retain control, with a documented porting process.	The number sits with the vendor and porting is undefined.

One honest caveat about how to read the answers. A small vendor without a SOC 2 report is not automatically worse than a large one that has one. Certifications are expensive and slow, and plenty of competent small teams have not bought one yet. What matters is whether the answers are specific, consistent with each other, and given in writing. Specificity is hard to fake across a whole questionnaire.

Frequently asked questions

Is an AI voice agent secure enough for a medical or dental clinic?

It depends entirely on how the specific deployment is configured, not on the technology in the abstract. Health information is treated as a special category under GDPR, with a higher bar for processing, so a clinic needs EU-hosted storage, a defined and short retention period, contractual assurance that recordings are never used to train models, tight access controls at the vendor, and a written data processing agreement listing every sub-processor. Many clinics also narrow the assistant deliberately so it books and reschedules but never discusses clinical detail.

Where should my call recordings and transcripts be stored?

For an EU business the simplest defensible answer is inside the EU or the EEA, because it removes an entire category of international transfer questions rather than managing them. Ask for the specific region, not the vendor's head office country, and ask separately about the storage location and the location where the speech recognition and language model processing actually happens. Those are often different providers in different jurisdictions, and the answer for one does not cover the other.

How do I stop a vendor using my customer calls to train AI models?

Get it in the contract rather than in an email. Ask for an explicit clause stating that your call audio, transcripts and derived data are not used to train, fine-tune or improve the vendor's models or those of any third party, and that the same restriction flows down to every sub-processor. A verbal assurance from a salesperson is worth nothing at renewal time or after an acquisition. Reputable model providers offer enterprise terms that support this, so a vendor unable to commit is telling you where their data actually goes.

What does encryption in transit and at rest actually mean?

In transit means the data is scrambled while it moves between systems, so anyone intercepting the connection sees noise instead of a conversation. At rest means it is scrambled while sitting in storage, so someone who obtains a copy of the disk or a database backup cannot simply read it. You want both. A vendor should be able to name the standards they use without hesitation, and should also be able to say who holds the decryption keys, which is the question that separates real protection from a marketing bullet.

Do I have to tell callers that the call is being recorded?

In the EU, recording a call captures personal data, so you need a lawful basis, a clear purpose and a notice that the caller can understand before the recording begins. Several member states apply additional national rules, so check your own jurisdiction. Practically, this is a short line at the start of the call, kept separate from the disclosure that the caller is speaking to an AI system. Those are two different notices doing two different jobs, and merging them tends to make both unclear.

What should a vendor do if they have a data breach?

They should tell you promptly and in enough detail that you can act, because as the controller the reporting obligation lands on you. GDPR requires notification of a personal data breach to the supervisory authority without undue delay and, where feasible, within 72 hours where notification is required, so a vendor commitment to notify you within a vague reasonable period does not work. Ask for a defined notification window in the contract, a named contact, and confirmation of what information they will provide.