Security Policy

Version 1.7 · Last updated 2026-09-04 · legal@prestancelab.com

This Policy describes the technical and organizational measures Prestance Lab applies to protect Customer Data processed through the Services. It is referenced from Prestance Lab's General Terms and Conditions and from the Data Processing Agreement, and reflects the safeguards in place across our infrastructure, encryption, access-control, and AI processing layers.

1. Overview

Prestance Lab operates a multi-tenant Software-as-a-Service platform: an AI assistant that retail sales advisors reach by telephone, WhatsApp, SMS or email (and through an optional mobile application) to prepare for a client, debrief after a visit, draft a follow-up, know the products, and practise a hard conversation with the assistant playing the client; managers receive aggregated team signals from it. The platform processes the advisor's voice and text exchanges with the assistant, the client files the advisor builds through those exchanges, and practice sessions. It never records, listens to, or contacts the Customer's clients. This document summarizes the technical and organizational measures (the "TOMs") we apply to safeguard Customer Data, in alignment with the commitments set out in our General Terms and Conditions and our Data Processing Agreement.

2. Hosting and infrastructure

The Services are operated on independently audited, enterprise-grade infrastructure providers. Core infrastructure is pinned to Europe: the application runtime and media transport in the European Union, the database in the United Kingdom under the European Commission's adequacy decision; the AI inference providers and their respective countries of processing are itemized below and in the DPA, §7.

Database & backend: EU-hosted PostgreSQL with daily encrypted backups and point-in-time recovery. Hosting region: London (United Kingdom, AWS eu-west-2), covered by the European Commission's adequacy decision for the United Kingdom. Provider listed in the DPA, §7.
Application backend: EU-hosted application runtime serving the API, the voice-agent worker, the messaging gateways for the telephone, WhatsApp, SMS and email channels, the advisor-memory service, and the manager surfaces. Hosting region: Germany (EU).
Voice transport: WebRTC SFU operated in EU region (eu-central), encrypted in transit via DTLS-SRTP on every leg, with SIP ingress for telephone calls. Provider listed in the DPA.
Real-time voice AI (live stage): The advisor's calls with the assistant and voice practice sessions run on Google's real-time speech model, reached through the Gemini API on a billing-enabled Google Cloud project under Google's Paid Services terms and Data Processing Addendum, on infrastructure in the United States (no EU data residency), with Standard Contractual Clauses and no training on Customer Data. Speech-to-text transcription of those same calls runs on ElevenLabs in the United States, under enterprise terms with Standard Contractual Clauses and no training on Customer Data. Providers and transfer mechanisms listed in the DPA, §7.
Assistant model (backend stage, proprietary): The workflows behind the assistant — client files and briefs, follow-up drafts, practice feedback, team signals — run on our proprietary model, deployed and operated by Prestance Lab on dedicated Nebius cloud infrastructure in the European Union under a signed Data Processing Agreement. No third-party model provider processes Customer Data at this stage. Provider listed in the DPA, §7.
Messaging channels: WhatsApp, SMS and email reach the assistant through the channel providers listed in the DPA, §7; replies travel back the same way. Only enrolled numbers and addresses are served.
Mobile application (optional, on request): Flutter (iOS / Android, and as a browser-based web application). Runs on the Authorized User's device; no Customer Data is stored locally beyond authentication tokens.

Prestance Lab contracts only with sub-processors that hold independent third-party security audits (SOC 2 or ISO/IEC 27001). The complete sub-processor list — including entity name, country of processing, transfer mechanism, and DPA link — is maintained in the Data Processing Agreement.

3. Encryption

In transit

TLS 1.2 or higher is enforced on all application, database, API, and channel-provider connections. Voice sessions from the mobile application use WebRTC with DTLS-SRTP, so audio is encrypted on every leg between the advisor's device and the Prestance Lab worker; the SFU re-encrypts per leg, so this is transport encryption, not end-to-end encryption. Telephone calls travel over the advisor's mobile network to the telephony provider's edge, then over TLS-secured SIP with SRTP into the EU media transport. WhatsApp messages are end-to-end encrypted between the advisor's handset and the WhatsApp Business Platform and delivered to Prestance Lab over TLS. SMS is carried in clear text on the carrier leg by the nature of the medium; advisors are advised to prefer a call, WhatsApp, or email for client details.

At rest

All persistent data — database rows, object storage, backups, and the advisor-memory store on our own application server — is encrypted at rest using AES-256. For the managed stores, keys are managed by the provider in HSM-backed key-management services; the advisor-memory store is additionally reachable only over the server's private network, with no public database port.

4. Access control

Prestance Lab enforces a three-layer access-control model:

Application layer — identity- and workspace-scoped access: every request is bound to the Authorized User's identity and workspace, and data reads are scoped to their owner; roles (Advisor, Manager, Admin) are carried in the session token; and seat binding on the channels: a call or message is attributed to an Authorized User only when it originates from the telephone number or email address enrolled for that seat, and unknown senders are rejected. The enrolled identity is a sender filter, not an authentication factor: caller identification and sender addresses can be spoofed. Seats are confirmed at enrolment on the enrolled channel; the mobile application and the manager surfaces authenticate through Supabase Auth, by single sign-on with the Customer's identity provider (SAML 2.0 or OIDC — Microsoft Entra ID, Okta, Google Workspace, or any compliant provider) or by email and password with multi-factor authentication; a compromised or reassigned number or mailbox must be reported without undue delay (AUP §5), and additional caller verification on the telephone channel is scoped in the Order Form where the Customer requires it.
API layer — every Customer-facing endpoint requires a JWT (ES256, issued by Supabase Auth) and is validated against an explicit allow-list of claims; the only unauthenticated routes are liveness probes and signed, expiring links generated by the platform itself.
Database layer — Row-Level Security (RLS) policies on the tables that hold Authorized-User content (practice sessions, coach sessions, client personas and workspace files) enforce strict workspace and user isolation. Workspace isolation on the user-facing API paths is enforced at the application layer; the backend's own service connections sit outside RLS by design, are used only by Prestance Lab's server-side services, and are never exposed to clients.

All data is workspace-scoped, and within a workspace an advisor's exchanges are private to that advisor. The advisor's calls and messages with the assistant, the client files they build, and their practice sessions — recordings, transcripts, scores and coaching feedback — are readable by the advisor only. Managers and the Customer's administrators receive aggregated signals: activity counts (for example follow-ups sent, appointments kept, practice sessions run) and recurring conversation patterns drawn from debriefs, per team and per advisor — never a recording, a transcript, a practice score, or an individual's words. No Outputs are exported to the Customer's HR systems by Prestance Lab.

HR use of Outputs is restricted

Managers receive aggregated signals only; per-advisor transcripts, recordings and practice scores are not surfaced to them. The Customer is responsible for ensuring the signals it receives are not used as the sole or principal basis for any HR decision, as the basis for automated decision-making within the meaning of Article 22 GDPR, or to infer special-category data within the meaning of Article 9 GDPR. The substantive prohibition is set out in our Acceptable Use Policy §4.

5. AI and data privacy

No training by sub-processors on Customer Data

The assistant's AI runs in two stages. The backend stage — client files and briefs, follow-up drafts, practice feedback, team patterns — runs on our proprietary model, deployed and operated by Prestance Lab on Nebius cloud infrastructure in the European Union: no third-party model provider processes Customer Data at that stage, and nothing is trained on it. The live stage — the real-time voice interaction on calls with the assistant and in practice sessions — runs on Google's real-time speech model through the Gemini API on a billing-enabled Google Cloud project, under Google's Paid Services terms and Data Processing Addendum, under which Customer Data is not used to train or improve Google's models; the speech-to-text transcription of those calls runs on ElevenLabs under enterprise terms carrying the same no-training commitment. No Customer Data is used to train any model, ours or a provider's. OpenAI and AWS Bedrock are not used; the full provider list is the DPA, §7.

The Customer's clients are never recorded or contacted

The Solution captures audio only on the advisor's own calls with the assistant and during practice sessions. It has no presence in the room during a client conversation, and no microphone is active while the advisor is with a client. The assistant drafts client-facing messages; every such message is sent by the advisor from their own tools. The Solution never calls, messages, or emails a client of the Customer.

Temporary retention for abuse monitoring

Temporary retention for abuse monitoring at the provider level may apply (typically ≤ 30 days). Sub-processors may apply human review to content flagged by automated abuse-monitoring systems, in accordance with each provider's published policy. Prestance Lab does not control this review and surfaces the relevant provider policies in the DPA.

Voice recordings

Voice recordings of the advisor's calls with the assistant and of practice sessions are created by Prestance Lab's worker via the LiveKit Egress API and uploaded directly to a Prestance-controlled storage bucket in the United Kingdom (see §5, Data residency). Recording retention is governed by the Customer's Order Form and the Data Processing Agreement. Recordings capture the complete audio of the call between the advisor and the assistant and are not anonymized or de-identified; they remain personal data throughout their retention. They are readable by the advisor only.

Data residency

All persistent Customer Data is hosted in Europe: Supabase London (United Kingdom, AWS eu-west-2, under the European Commission's adequacy decision for the United Kingdom) for the database, authentication and object storage; Hetzner (Germany, EU) for the application, voice-agent worker, messaging gateways and advisor memory; LiveKit eu-central (Frankfurt, media transport); and Prestance-operated GPU inference services (the knowledge reranker and the duo-drill speaker classifier) on Google Cloud in Zurich (Switzerland, under the European Commission's adequacy decision for Switzerland), for inference only. AI processing in the United States, under Standard Contractual Clauses, is limited to the live stage: the real-time voice interaction on calls with the assistant and in practice sessions (Google) and the speech-to-text transcription of those calls (ElevenLabs), with no EU data residency. The backend stage runs on our proprietary model, deployed by Prestance Lab on Nebius infrastructure in the European Union under a signed Data Processing Agreement, with no persistent storage there. The telephone, WhatsApp, SMS and email channel providers are US-headquartered and carry call signalling and message content in transit under Standard Contractual Clauses; Prestance Lab's own persistent copy of every exchange lives in Europe, in the regions stated above. Observability, transit and abuse-monitoring data that a vendor retains itself (for example LiveKit's US-side observability data, or a channel provider's message logs) may additionally sit in the United States for the period stated in that vendor's DPA. The provider, country of processing, and transfer mechanism for each are disclosed in the Data Processing Agreement, §7.

6. Data ownership and retention

The Customer remains the holder of all rights, title, and interest in and to Customer Data, in accordance with GTC §2.5.
Prestance Lab processes Customer Data solely to provide the Services and as further described in the Data Processing Agreement.
Aggregated or anonymous usage metrics may be used to operate, secure, and improve the Services in accordance with GTC §2.5; no personal data or Confidential Information is used for this purpose.
Any data — an advisor's exchanges, a client file, a recording, a practice session with its scores and feedback — is deletable on Customer request by emailing privacy@prestancelab.com.
On termination of the Agreement, all Customer Data is permanently deleted within 30 days, save for backups, which age out of the 30-day backup retention described in §8 (90 days maximum).

7. Sub-processors

The complete list of sub-processors, including activity, country of operation, and transfer mechanism, is maintained in the Data Processing Agreement. Changes to the list are notified to active Customers in accordance with the procedure described therein.

8. Operational security

Account hygiene

All Prestance Lab corporate accounts use multi-factor authentication. API keys are rotated on personnel change and on any suspected exposure.

Personnel and contractors

Prestance Lab maintains an internal Acceptable Use Policy binding all employees, interns, and contractors with access to Prestance Lab systems, code, or Customer Data. It covers device security, credential handling, approved tooling for work on Customer Data, and offboarding. Contractors acknowledge it in writing as a condition of access and remain subject to it for the duration of the engagement.

Secrets management

Production secrets are held in 1Password vaults, loaded into the deploy job environment, and passed by the deploy tooling to the application containers at deploy time; they are never committed to source control.

Patching

Application dependencies are scanned weekly. Critical vulnerabilities are patched within 7 days of public disclosure.

Backups

PostgreSQL backups are taken daily and stored encrypted, with a retention period of 30 days. Point-in-time recovery is available to a granularity of 5 minutes within the preceding 7 days.

Incident response

A documented runbook covers detection, containment, eradication, recovery, and post-incident review. Personal Data Breaches are notified to the Customer without undue delay, in accordance with the Data Processing Agreement.

9. Compliance posture

GDPR

Compliant. European hosting is in effect (EU for the application tier, UK under the adequacy decision for the database tier); a Data Processing Agreement is executed with each Customer; sub-processor DPAs are in place; Standard Contractual Clauses apply to any non-EU sub-processor transfer.

EU AI Act

Prestance Lab acts as the provider of the Solution within the meaning of the EU AI Act and complies with the provider obligations under Articles 25 et seq. The Solution does not perform emotion recognition in the workplace within the meaning of Article 5(1)(f), and voice is never used for biometric identification.

SOC 2

Prestance Lab is actively working toward SOC 2 Type I readiness and intends to begin a formal observation period; a formal observation period has not yet started. All infrastructure sub-processors hold an independent third-party audit (SOC 2 Type II or ISO/IEC 27001).

10. Reporting a security concern

Email security@prestancelab.com.
We will acknowledge receipt within 1 business day and provide updates as the investigation progresses.
Coordinated disclosure: please allow a reasonable window for remediation before any public disclosure.

11. Updates to this Policy

In accordance with GTC §2.7, Prestance Lab may update this Policy. Material changes will be notified to active Customers at least 30 days in advance, unless a shorter timeframe is required by law or to address a material security risk.