Private by design, because every call carries PHI
A member services call is protected health information from the first sentence. Compliance is evaluated while the conversation is happening, not summarised after it, so a call can be steered before it becomes an incident.
Checked during the call, not after it
Most compliance tooling reports on what already happened. The useful moments are earlier: before the dial connects, and during the turn where something is said that has to be handled a particular way.
Instructions a prompt cannot override
Underneath whatever a customer writes, every call carries a fixed set of safety instructions. They take priority over the prompt above them and they are not editable in the product, on purpose.
They exist because a voice agent takes instructions from whoever is talking to it. Without a floor, a caller can talk an agent out of its own rules, and the agent will be helpful about it. With one, an unusual request falls back to the safe behaviour and the call carries on.
Who can see what
Access is scoped twice. An organization role decides what you are across the account. A workspace role decides what you are inside one part of it, which is how a claims team and an appeals team share a product without sharing everything in it.
Roles govern reading and changing separately. A viewer keeps its view of an agent without the ability to edit it, and a member can operate the things it can reach without gaining administrative power over them. Billing and deleting the organization stay with the owner.
A record of every change
Who altered a prompt, who granted a role, who exported a set of call records, when an API key was rotated. It is recorded and filterable, which is what turns an awkward question into a query.
How the data is held
Calls, recordings and transcripts are encrypted with AES-256 at rest and TLS in transit, on US infrastructure. The architecture is HIPAA-ready end to end, and BAAs are available on request.
Model access runs on keys we hold with each vendor, on their enterprise terms, and the catalogue is restricted to models we can actually route rather than anything a picker will accept.
Answers you can trace
Grounding is a security property as much as a quality one. When an agent answers from an attached plan document and cites the section, the answer is auditable: someone can go and read exactly what the agent read.
Combine that with per-call analysis and its evidence timestamps and you can reconstruct any call from the outside. What was said, what it was based on, and what was promised. That is the difference between a system you can put in front of members and one you cannot.
Advanced imaging needs prior authorization. Standard review is three business days.