Security & compliance
Mapped to the rulebook, not a badge.
What we do on every call, which rule each control maps to, and what we do not claim.
RBI Fair Practices CodeRBI IT outsourcing directionsIRDAIDPDP Act 2023TRAI TCCCPR / DLTCERT-In
Your recordings train your model —
and no one else's.
Never a shared or foundation model, not even anonymised. Your weights are yours. Your data stays in your region. It is in the contract.
Controls on every call
Between "hello" and "goodbye".
14:02:11consent_capturedlang=hi-IN✓
14:02:15identity_verifiedmethod=dob✓
14:02:19pii_redactedfields=aadhaar,card✓
14:02:40policy_checkrbi_fpc.calling_hours✓
14:03:12ptp_captureddate=2026-09-19✓
14:03:40recording_encryptedAES-256 · region=ap-south-1✓
| Control | Maps to |
|---|---|
| AI disclosure & consent, logged at call start in the customer's language | DPDP Act 2023 · TRAI · IRDAI tele-calling |
| Calling-hour and frequency limits, enforced by the dialer, not the script | RBI FPC · RBI outsourcing directions |
| No-pressure language: frozen lines, banned-phrase checks per turn | RBI FPC · recovery-agent guidelines |
| PII redaction in text and audio; DTMF masking for OTP and card | DPDP Act 2023 · PCI DSS scope |
| Grounded amounts, read from your system of record | Fair disclosure · IRDAI mis-selling |
| Warm human transfer on distress, legal threat or grievance | RBI / IRDAI grievance norms |
| Encrypted recordings with automated retention and deletion | DPDP Act 2023 · RBI record-keeping |
Learning under control
What learns, what never does.
Agents fine-tune weekly on your graded, redacted calls. A stronger claim needs stronger controls.
🔒 Frozen · never learnsversion-hashed, verified on every release
- "Yeh call record ho rahi hai." — recording disclosure
- "Main AI assistant hoon." — AI disclosure
- Grievance redressal line and helpline number
- RBI Fair Practices Code calling-hour and tone rules
- IRDAI product-claim restrictions
Learns · under approval
- Objection handling and phrasing per language
- Intent recognition (new customer phrasings)
- Number, date and amount pronunciation
- Handle-time and turn-taking behaviour
| Control | Maps to |
|---|---|
| Consent-scoped training: only consented calls | DPDP Act 2023 · IRDAI / RBI recording |
| Redaction before storage, text and audio | DPDP Act 2023 · PCI DSS scope |
| Per-tenant weights, never shared | RBI IT outsourcing · contractual |
| Frozen compliance lines, version-hashed | RBI FPC · IRDAI disclosure |
| Human approval gate, named sign-off | Model risk management · audit |
| Canary + one-click rollback | Change management · incident response |
| Pause or freeze learning, any time | Your policy |
Regulator map
One control set, four rulebooks.
RBI
Fair Practices Code & outsourcing
- Calling-hour and frequency limits, enforced by the dialer
- No-pressure language; frozen lines, banned-phrase checks per turn
- Warm human transfer on grievance
- Encrypted record-keeping; per-tenant weights under IT outsourcing directions
IRDAI
Tele-calling & disclosure
- AI disclosure and consent at call start, in the customer's language
- Grounded amounts from your system of record; no mis-selling
- Frozen disclosure lines, version-hashed
- Grievance norms: warm transfer on distress
DPDP Act 2023
Consent & personal data
- Consent logged at call start
- PII redaction in text and audio; DTMF masking for OTP and card
- Encrypted recordings with automated retention and deletion
- Consent-scoped training: only consented calls
TRAI · CERT-In
Telecom & incident norms
- TCCCPR consent and DLT-registered headers and templates
- Region-pinned telephony, your SIP trunk or an Indian CPaaS
- Canary releases with one-click rollback; incident response
Certifications & assurance
Status, stated plainly.
ISO 27001
Information security management
Ask for current state confirmSOC 2
Security and confidentiality criteria
Ask for current state confirmVAPT
External penetration testing
Ask for latest report confirmRBI outsourcing pack
Pre-filled due-diligence responses
Available on requestEvidence pack available under NDA.
Sub-processors
Who touches the call path.
In cloud, providers are pinned to India where available. In VPC and on-prem, you choose.
Telephony
Your SIP trunk or an Indian CPaaS, with DLT-registered headers and templates.
Speech recognition
Region-pinned providers (e.g. Deepgram, Sarvam, Azure) or self-hosted on-prem.
Language models
Provider APIs under zero-retention terms, or self-hosted open models on GPUs.
Voice synthesis
Region-pinned providers (e.g. Cartesia, ElevenLabs, Sarvam) or self-hosted voices.
Honest about limits
What we do not claim.
Does the agent ever get an amount wrong?
It cannot invent one: every figure comes from your system of record. If lookup fails, it escalates. Hearing the customer can still fail in noise, so confirmations are read back.
Can speech recognition fail?
Yes — noise, poor lines and unusual accents reduce accuracy. Low confidence triggers re-asks, then a human transfer. We publish word-error rates from your pilot, not benchmarks.
Does anyone at FormantAI hear recordings?
Only in client-approved QA and pilot tuning, by named engineers, under logged access, redacted where feasible. VPC and on-prem can disable this entirely.
Do provider APIs see our data?
In cloud, yes — under zero-retention terms and region pinning where available. If your mandate excludes them, we self-host models in your environment.
Is the AI disclosed to customers?
Yes, at the start of every call in the customer's language, stored verbatim and unparaphrasable by the model.
Under NDA
Get the security pack.
Data-flow diagrams, control evidence, sub-processor locations and pre-filled RBI outsourcing responses.
Request the security packCompliance
Talk it through first.
Walk the control map and the limits with the person who owns it.
Talk to our compliance lead