Security & compliance

Built for the audit you hope never happens

Consent proof, suppression, local quiet hours, attempt caps, least-privilege access and an append-only audit trail - enforced by the system, not by a checklist someone forgot to follow.

TCPA / FCC-aligned controls
HIPAA & GDPR-ready handling
Row-level tenant isolation
Append-only audit log

Contact for a demo Hear a sample call

Guardrails

Enforced at dial time, on every attempt

Rules live in the platform, so a rushed campaign can't route around them: every call re-checks consent, suppression, local window and attempt caps before the carrier is ever asked to dial.

SYSTEM_SECURE_v4.1

Compliance guardrails

Consent, suppression, recipient-local quiet hours, attempt caps and campaign review are evaluated together. If any check fails, nothing leaves the building - the contact is skipped, the reason is stored, and an audit entry is written.

Consent

Suppression

Quiet hours

Attempt caps

Review gate

consent · pass suppression · pass quiet hours · pass attempt cap · pass

ELIGIBLE

Credentials never touch the client

Twilio, Telnyx, SignalWire, Vapi and Retell keys live in backend secrets. The console shows configuration state and webhook health only.

Consent ledger with proof

Every contact carries channel-level consent records: captured timestamp, source, disclosure text, proof link and IP.

Review gate before activation

Campaigns cannot leave review without a signed-off checklist. Live mode stays locked until an owner unlocks it.

Immutable audit trail

Blocked attempts, opt-outs, suppression edits, reviews and activations are appended to the audit log and never edited.

Instant opt-out handling

An inbound STOP suppresses the channel immediately, before any queued message or dial can go out.

Row-level tenant isolation

Every table is organization-scoped with row-level security, so no query can cross a workspace boundary.

Frameworks the controls are built around

Blankname ships the operational controls that regulated outreach programs are asked for: consent proof, suppression, quiet hours, attempt caps, least-privilege access and an append-only audit trail. Each framework below maps to controls you can point an auditor at.

TCPA & FCC rules

US voice / SMS

Prior express written consent, disclosure text and per-channel revocation are enforced before an attempt is built.

Consent record with timestamp, source, IP and proof link
Immediate revocation on STOP or verbal opt-out
AI/artificial-voice disclosure required in scripts

FTC Telemarketing Sales Rule

TSR / DNC

National and internal do-not-call handling, calling windows and identification requirements.

National + internal DNC suppression on every attempt
Recipient-local quiet hours (8am–9pm default window)
Caller identity and purpose stated in the opening line

State mini-TCPA laws

FL · OK · MD · WA

Stricter state windows, consent language and attempt limits applied per contact location.

Per-state calling windows and attempt caps
Timezone resolved from the contact's own number and address
Blocked attempts stored with the failing rule

HIPAA

PHI safeguards

For healthcare outreach: minimum-necessary messaging, access control and full traceability of who saw what.

PHI-minimizing scripts - no diagnosis or treatment detail in voice or SMS
Role-based access, row-level tenant isolation, encryption in transit and at rest
Append-only audit log of every access, attempt and transfer
BAA required with carrier and voice vendors before live PHI use

GDPR · UK GDPR

EU / UK

Lawful basis, data-subject rights and retention handled as first-class objects, not spreadsheets.

Lawful basis and consent evidence stored per contact
Export, rectify and erase a contact with its call history
Configurable retention windows for recordings and transcripts

CCPA / CPRA · PIPEDA

US states · Canada

Opt-out of sale/sharing, deletion requests and Canadian express-consent rules.

Do-not-contact and deletion requests honored across voice and SMS
Per-contact record of the request and who processed it
No contact data sold or shared with third parties

CTIA & 10DLC

SMS deliverability

Carrier messaging rules for registered campaigns, opt-in language and mandatory keywords.

Brand and campaign registration tracked per sending number
STOP / HELP keywords handled automatically
Opt-in language stored with every SMS-consented contact

SOC 2-aligned operations

Security controls

The control set an auditor asks about: access, change management, monitoring and logging.

Least-privilege roles and owner-only live-mode unlock
Provider keys in backend secrets, never in the browser
Signed provider webhooks with HMAC verification

PCI DSS scope reduction

No card data

Blankname never collects payment card data on calls or messages, keeping your program out of scope.

No card fields anywhere in scripts, SMS or lead capture
Transfers hand payment steps to your own PCI-compliant systems
Recording redaction hooks for sensitive segments

These are product capabilities, not certifications or legal advice. HIPAA also requires a signed BAA with each vendor that touches PHI, and formal attestations such as SOC 2 or ISO 27001 are issued by an independent auditor for your own deployment. We review scope, data flows and paperwork with you before you go live.

See it run on your own campaign

Tell us what you dial and we'll walk you through the console live: AI script generation, cadence and attempt caps, the compliance review gate, an AI smart engine call end to end, a warm transfer to a rep, and the cost per completed call at your volume.