Trust & Safety

Security & Compliance

Vomyra processes real phone calls. This page covers what data is collected, how long it is retained, how your system prompt and callers' conversations are protected, and what your obligations are under India's DPDP Act, GDPR, HIPAA, and telecom regulations.

How data flows through a call

Every call passes through four processing stages. Understanding this helps you apply the right data-handling decisions.

Audio capture

Caller audio is streamed to the transcription provider (Azure, Deepgram, or others). Raw audio is not stored by Vomyra � only the resulting transcript.

Transcription

Speech is converted to text in real time. The transcript is passed to the language model and is retained per the retention schedule below.

LLM inference

The language model (OpenAI, Meta, etc.) receives the transcript and system prompt and decides the next response. Prompts and responses are not stored by the model provider beyond their own retention policies.

Tool calls

If Myra calls a tool, the request and response are passed in memory. Tool payloads are not persisted by Vomyra � they exist only for the duration of the call.

What is stored and for how long

Default retention periods. Contact support to configure longer retention for compliance archiving or shorter retention to minimise data exposure.

Data type	Retention	Notes
Call recordings	30 days (default)	Extended retention available on request
Transcripts	30 days (default)	Includes speaker labels and timestamps
Call metadata	90 days	Duration, phone numbers, assistant used, outcome
System prompts	Until deleted	Stored per-assistant; not included in call records
API keys	Until revoked	Hashed at rest; never returned in plaintext after creation
Tool request/response payloads	Not stored	Tool calls are ephemeral; results are not persisted

All Vomyra calls are recorded and transcribed by default. You are responsible for obtaining the necessary consent from callers under applicable law.

Your legal obligation

In India, consent to record is implied for business calls when the caller is notified. In some US states (e.g. California) and the EU, all-party consent is required. Disclose recording in Myra's first message or IVR before the conversation starts.

Example disclosure in first message

Namaste! Aapka swagat hai. Yeh call quality assurance ke liye record ki ja sakti hai. Kaise madad karun?

Adapt the disclosure to your language and jurisdiction. The disclosure must come before Myra asks for personal information.

Compliance frameworks

Vomyra is a data processor. You are the data controller responsible for compliance with laws applicable to your jurisdiction and use case.

DPDP Act (India)

India-specific

India's Digital Personal Data Protection Act governs how personal data of Indian residents is processed. For voice agents: collect only what is needed for the booking or query, disclose recording in your first message, and honour deletion requests. Vomyra's 30-day default retention aligns with minimal-retention principles.

GDPR (EU)

If you operate in the EU or handle EU resident data, treat call recordings as personal data under GDPR. Obtain consent before recording, provide a lawful basis for processing, and respond to subject-access requests. Contact support to discuss data processing agreements (DPAs).

HIPAA (US healthcare)

Vomyra can be used in healthcare contexts but you are responsible for ensuring PHI handling meets HIPAA requirements. Keep Myra's scope narrow (scheduling, triage routing) and do not instruct it to read out or collect protected health information it does not need. Contact sales for a BAA.

TRAI / DND (India)

Telecom

Outbound calls in India require DLT registration and must comply with TRAI's Do Not Disturb regulations. Do not call numbers on the NDNC registry without prior consent. Promotional calls are restricted to 9am�9pm. See Indian Phone Numbers for number compliance.

TCPA (US)

US Telecom

For outbound calls to US numbers, the Telephone Consumer Protection Act requires prior express written consent for autodialled or pre-recorded calls. Maintain opt-out records and honour do-not-call requests within 30 days.

Security practices

All data in transit is encrypted with TLS 1.2+.

Data at rest is encrypted using AES-256.

API keys are hashed on storage and never returned in plaintext after creation.

System prompts are scoped to your account and inaccessible to other tenants.

Dashboard access is protected by email verification. SSO is available on enterprise plans.

Vomyra does not train models on your call data.

Indian Phone Numbers

TRAI, DLT registration, KYC, and 140/160-series number compliance for Indian voice calls.

Authentication

API key management, webhook verification, and tool authentication best practices.

Webhooks & Events

Push call events to your systems securely � including HMAC verification.

Billing

Pricing structure, call costs, and KYC requirements for live phone calls.

How data flows through a call

Every call passes through four processing stages. Understanding this helps you apply the right data-handling decisions.

Audio capture

Caller audio is streamed to the transcription provider (Azure, Deepgram, or others). Raw audio is not stored by Vomyra � only the resulting transcript.

Transcription

Speech is converted to text in real time. The transcript is passed to the language model and is retained per the retention schedule below.

LLM inference

Tool calls

If Myra calls a tool, the request and response are passed in memory. Tool payloads are not persisted by Vomyra � they exist only for the duration of the call.

What is stored and for how long

Default retention periods. Contact support to configure longer retention for compliance archiving or shorter retention to minimise data exposure.

Data type	Retention	Notes
Call recordings	30 days (default)	Extended retention available on request
Transcripts	30 days (default)	Includes speaker labels and timestamps
Call metadata	90 days	Duration, phone numbers, assistant used, outcome
System prompts	Until deleted	Stored per-assistant; not included in call records
API keys	Until revoked	Hashed at rest; never returned in plaintext after creation
Tool request/response payloads	Not stored	Tool calls are ephemeral; results are not persisted

Recording consent

All Vomyra calls are recorded and transcribed by default. You are responsible for obtaining the necessary consent from callers under applicable law.

Your legal obligation

Example disclosure in first message

Namaste! Aapka swagat hai. Yeh call quality assurance ke liye record ki ja sakti hai. Kaise madad karun?

Adapt the disclosure to your language and jurisdiction. The disclosure must come before Myra asks for personal information.

Compliance frameworks

Vomyra is a data processor. You are the data controller responsible for compliance with laws applicable to your jurisdiction and use case.

DPDP Act (India)

India-specific

GDPR (EU)

HIPAA (US healthcare)

TRAI / DND (India)

Telecom

TCPA (US)

US Telecom

Security practices

All data in transit is encrypted with TLS 1.2+.

Data at rest is encrypted using AES-256.

API keys are hashed on storage and never returned in plaintext after creation.

System prompts are scoped to your account and inaccessible to other tenants.

Dashboard access is protected by email verification. SSO is available on enterprise plans.

Vomyra does not train models on your call data.

Security & Compliance

How data flows through a call

What is stored and for how long

Compliance frameworks

Security practices

Related pages

Indian Phone Numbers

Authentication

Webhooks & Events

Billing

Security & Compliance

How data flows through a call

What is stored and for how long

Compliance frameworks

Security practices

Related pages

Indian Phone Numbers

Authentication

Webhooks & Events

Billing