--- title: "Ringg AI Security: SOC 2 Type II, ISO 27001, HIPAA, GDPR" description: "Ringg AI is SOC 2 Type II audited and ISO 27001 certified, supports HIPAA and GDPR workflows, and signs BAAs, DPAs and SCCs. See how Ringg handles your data." canonical_url: "https://www.ringg.ai/security" --- # Security and compliance at Ringg AI Ringg AI is SOC 2 Type II audited and ISO 27001 certified. It supports HIPAA and GDPR workflows, and signs a BAA, DPA or Standard Contractual Clauses when your data needs one. [Read the security docs](https://docs.ringg.ai/resources/security/security)[Visit the Trust Center](https://in.sprinto.com/trust-center/view/f74e3821-e588-44d8-b43d-1b3f91a0a972) Certifications SOC 2 Type II audited, ISO 27001 certified Regulated data HIPAA workflows under a BAA, GDPR with a DPA and SCCs Deployment India, GCC, United States, Europe, on-premise or your private cloud Legal entity Stoic AI Private Limited, Bengaluru Security contact [admin@ringg.ai](mailto:admin@ringg.ai) * ![GDPR compliant](https://www.ringg.ai/_next/image?url=https%3A%2F%2Fassets.ringg.ai%2Fimages%2Fcompliance%2Fgdpr.webp&w=128&q=75) * ![HIPAA compliant](https://www.ringg.ai/_next/image?url=https%3A%2F%2Fassets.ringg.ai%2Fimages%2Fcompliance%2Fhipaa.webp&w=128&q=75) * ![ISO 27001 certified](https://www.ringg.ai/_next/image?url=https%3A%2F%2Fassets.ringg.ai%2Fimages%2Fcompliance%2Fiso27001.webp&w=128&q=75) * ![AICPA SOC 2 certified](https://www.ringg.ai/_next/image?url=https%3A%2F%2Fassets.ringg.ai%2Fimages%2Fcompliance%2Fsoc2.webp&w=128&q=75) ## Certifications and compliance Certificates, reports and the latest audit status are in the Ringg Trust Center. Audited ### SOC 2 Type II An audit of the design and operating effectiveness of Ringg’s controls over a defined period. Certified ### ISO 27001 Certified to the international standard for information security management systems. Supported ### GDPR Data-subject rights and safeguards for cross-border transfers, as described in the Privacy Policy. BAA available ### HIPAA Supports appropriately configured voice AI workflows for healthcare organizations, under a signed BAA. [Visit the Trust Center](https://in.sprinto.com/trust-center/view/f74e3821-e588-44d8-b43d-1b3f91a0a972) ## Agreements for regulated data Regulated data needs the matching agreement in place before it goes through Ringg. | Agreement | When you need it | | --- | --- | | Business Associate Agreement (BAA) | Before protected health information (PHI) passes through Ringg in a covered healthcare workflow. It must be signed first. | | Data Processing Addendum (DPA) | To set out how personal data is processed and what Ringg and you are each responsible for. | | Standard Contractual Clauses (SCCs) | As a transfer mechanism when personal data moves between countries. | To request any of them, or to check which apply to your use, email [admin@ringg.ai](mailto:admin@ringg.ai). ## How Ringg handles your data Where it runs, who processes it, how long it stays, and what happens if something goes wrong. ### Deployment that runs where your data has to live Pick the region your policy needs. In-region and on-premise setups are enterprise options, scoped around compliance and data residency. * India * GCC * United States * Europe ### Encrypted calling data The names, numbers and other details you share to place calls are encrypted. Recordings and transcripts of completed calls are stored with their analytics. ### Named sub-processors Ask for the list of named sub-processors. By default, OpenAI and Gemini process conversational data and telephony providers carry call audio. On request, Ringg deploys the whole stack on-premise or in your private cloud, with a small language model, Parrot speech-to-text and a text-to-speech model, all hosted in-house. Transfers outside India use safeguards such as SCCs, and deployments in the UAE, Saudi Arabia, the EU and the US follow the same process. [About Parrot speech-to-text](https://www.ringg.ai/models/speech-to-text) ### Kept only as long as needed Personal data is kept only as long as its purpose, the law, a dispute or an agreement requires, then securely deleted or anonymized. Keep the recordings you need in your own storage. ### Breach notification Ringg has procedures for suspected security breaches and notifies you and any applicable regulator where the law requires it. ## Controls in your workspace What your team uses to keep access tight and calls within policy. ### Sign-in and roles * Continue with Google, or with email and a 6-digit one-time code * New members start as View only; edit access is granted per area * Workspace logs record changes for review ### API and webhooks * One server-side API key per workspace, which you can rotate * Web widget keys work only on the sites you allow * Webhooks can carry a secret header your endpoint checks ### Calls and spending * Calling windows and call limits keep contact within your policy * Credit balance alerts flag unexpected spending * Recordings can be downloaded into your own storage Your calls, your rules Tell people they are talking to an AI agent and that the call is recorded where the law requires it, honor opt-outs and do-not-call requests, and follow the rules that apply to you, such as GDPR, HIPAA or PCI DSS. [Secure your side of the integration](https://docs.ringg.ai/resources/security/security) ## Requests and contacts [ ### Reports, questionnaires and agreements Compliance reports, certificates, security questionnaires, the sub-processor list, and BAA, DPA or SCC requests. admin@ringg.ai](mailto:admin@ringg.ai)[ ### Access or delete personal data Include enough to identify the account or data. Ringg may verify your identity first. admin@ringg.ai](mailto:admin@ringg.ai)[ ### Data Protection Officer Complaints are acknowledged within 48 hours and resolved within 15 days. Kali C V, Chief Technology Officer](https://www.ringg.ai/grievance-officer)[ ### Privacy Policy How Ringg collects, uses, stores, shares and protects personal data. Read the Privacy Policy](https://www.ringg.ai/privacy) ## Security and compliance FAQs ### Is Ringg AI SOC 2 Type II compliant? Yes. Ringg AI is SOC 2 Type II audited: the audit covers the design and operating effectiveness of Ringg’s controls over a defined period. The report and the latest audit status are available through the Ringg Trust Center. ### Is Ringg AI ISO 27001 certified? Yes. Ringg AI is certified to ISO 27001, the international standard for information security management systems. The certificate is available through the Ringg Trust Center. ### Is Ringg AI HIPAA compliant? Ringg supports appropriately configured voice AI workflows for healthcare organizations and signs a Business Associate Agreement (BAA). The BAA must be signed before protected health information (PHI) passes through Ringg. Email admin@ringg.ai to request one. ### Does Ringg AI support GDPR? Yes. Ringg supports data-subject rights and safeguards for cross-border transfers, as described in its Privacy Policy. Ringg signs a Data Processing Addendum (DPA), and Standard Contractual Clauses (SCCs) when personal data moves between countries. ### Where does Ringg store and process data? Ringg deploys in India, GCC, United States, Europe, or on-premise or in your private cloud as an enterprise option, scoped around your compliance and data residency needs. Data may be processed outside India where Ringg’s cloud and technology partners operate, with safeguards such as standard contractual clauses. Deployments in the UAE, Saudi Arabia, the EU and the US follow the same process. ### Does Ringg use customer data to train AI models? Ringg’s Privacy Policy allows anonymized and aggregated data to be used to train and improve its AI models, with safeguards so the data cannot be linked back to individuals. You can opt out of having your data used for training. Data received from Google Workspace APIs is never used to train generalized AI or machine learning models. ### Which third parties process data for Ringg? By default, OpenAI and Gemini process conversational data, telephony providers carry call audio, a payment processor handles payments, and Google provides sign-in, all bound by confidentiality and data processing agreements. Email admin@ringg.ai for the named sub-processors. On request, Ringg deploys the whole stack on-premise or in your private cloud, with a small language model, Parrot speech-to-text and a text-to-speech model, all hosted in-house. ### How do I get Ringg’s SOC 2 report or send a security questionnaire? Request compliance reports and certificates through the Ringg Trust Center. For security questionnaires, the sub-processor list, or a BAA, DPA or SCCs, email admin@ringg.ai. ### How do I request access to or deletion of my personal data? Email admin@ringg.ai with enough detail to identify the account or data. Ringg may verify your identity first, and some information is kept where the law requires it or for security, fraud prevention, dispute resolution or contractual reasons. ## Running a security review? Request the SOC 2 Type II report and ISO 27001 certificate through the Trust Center, or send your questionnaire to admin@ringg.ai. [Book a demo](https://www.ringg.ai/book-a-demo)[Visit the Trust Center](https://in.sprinto.com/trust-center/view/f74e3821-e588-44d8-b43d-1b3f91a0a972) Source: https://www.ringg.ai/security