Sign your Data Processing Addendum (DPA / AVV)
Direct Famulor customers, including resellers using their own workspace, request their DPA in Settings → Legal:
- Request: Choose Request DPA, enter your company and signer details, then choose Send for signing. Signing opens in a new tab and the agreement is sent by email.
- Existing requests: Continue signing or download the signed PDF from the same Legal page when available.
- Enterprise requests: For custom contractual requirements or signed PDF countersignatures, reach out directly via Milian.
Infrastructure security
Every layer of our platform is built on security-first principles.Encryption
AES-256 encryption at rest, TLS 1.3 in transit. Voice data, transcripts, and customer information are encrypted end-to-end across the full call lifecycle.Access control
Role-based access control (RBAC) and least-privilege principles across all systems. Every access is logged and auditable.Monitoring & detection
24/7 security monitoring with intrusion-detection systems, anomaly alerting, and comprehensive audit logging for all system activity.Business continuity
Automated backups, disaster-recovery procedures, and a 99.9% availability SLA. Redundant infrastructure across multiple availability zones.Incident response
A documented incident-response plan with defined escalation procedures, compliance with GDPR’s 72-hour breach-notification requirement, and post-incident review.Sub-processor security
Every AI sub-processor is reviewed for security and compliance before it’s added to the platform. Native, EU-resident plugins are used wherever available for the highest-sensitivity workloads (see Speech services below).1. Our sovereignty commitments
To meet the strict requirements of the European market — including GDPR Art. 9 for healthcare and other sensitive-data use cases — we operate on four principles:An earlier version of this page described a “Zero Retention Mode” that processed data purely in memory. That specific mode is not part of the current platform — minimization today works through the configurable retention windows above, down to one month. If your organization needs a stricter guarantee, chat with Milian in your dashboard.
AI inference region (workspace setting)
Under Settings → Workspace, AI inference region selects Global, EU or US for workspace AI processing. The model catalog is filtered to endpoints available in the selected region.- EU: models served through EU endpoints.
- US: models served through US endpoints.
- Global: automatic routing without an EU-only or US-only restriction. Voice processing uses the nearest available location.
2. System status & availability
Transparency about system performance matters to us. You can check live status and historical uptime per service at any time: Status page: https://status.famulor.io/ Subscribe on that page for incident updates. Historical uptime is shown per service. The platform availability target is 99.9% (see Business continuity).3. Infrastructure & platform hosting
These providers host the Famulor platform, including backend logic, databases, and the customer dashboard.
The database and application hosting remain in Frankfurt when the workspace AI region changes. Voice-agent workers and SIP infrastructure are available in both the EU and US; the model endpoint availability is listed in AI regions & models.
4. Artificial intelligence (LLM)
These models handle reasoning and conversation logic. Model access is routed through an AI gateway with enterprise-grade data handling; native, direct connections are used for select providers where EU data residency requires it. Note: The LLM provider is set automatically by the platform for most workspaces (see the standard table below) and is not manually selectable. Only workspaces with the Fallbacks & Guardrails add-on (“Automatic model fallback chains plus configurable guardrails for production reliability”) can choose the provider per assistant and configure additional fallback chains. Standard (without the Fallbacks & Guardrails add-on):
Additionally selectable with the Fallbacks & Guardrails add-on:
5. Speech services (STT & TTS)
Specialized providers for real-time transcription (speech-to-text) and speech synthesis (text-to-speech). Famulor’s engine-mode architecture (Pipeline / Realtime / Half-Cascade) determines which of these run for a given assistant. The realtime infrastructure (LiveKit) and the object storage (AWS) behind it are listed in section 3. Note: The STT provider (transcription) — like the LLM — is set automatically by the platform and is not manually selectable without the Fallbacks & Guardrails add-on. The TTS provider (voice synthesis, voice selection) can be chosen by any user regardless of the add-on — only the voices/providers available in the workspace region selected under AI inference region are shown. SIP trunk providers are selectable per assistant, depending on the use case.Not every provider listed above processes every call. Famulor selects EU-resident, native connections for higher-sensitivity workloads (Soniox, Gladia, Azure) and uses a managed inference path for the rest — both are covered by the transfer safeguards in section 10.
6. Business operations & billing
Providers for transactional security and administrative management.7. WhatsApp Business processing
For WhatsApp Business:- The integration connects directly to Meta’s WhatsApp Cloud API — not routed through Twilio.
- You can use either your own WhatsApp-enabled number or a number from the Famulor number pool (depending on setup/verification).
- If using your own number, the number owner must complete verification directly in Meta Business Manager.
- Inbound WhatsApp messages are processed through configurable LLM workflows.
- Replies are sent back as an AI-generated message.
- Text, images, and voice messages can be processed within the enabled assistant configuration and used for reply generation.
8. Platform analytics
For product analytics on the dashboard itself, Famulor uses:Famulor’s documentation site (docs.famulor.io) separately uses Google Analytics 4 and Microsoft Clarity for content analytics — these do not process data from your workspace or calls. White-label customers may optionally connect their own Google Tag Manager, GA4, or Meta Pixel to their own branded domain; that configuration and its data are the customer’s own.
9. Provider legal entities & addresses
The legal entity behind each provider, with a publicly available business address (as of the date below). Newer providers added since our last full review are marked — ask Milian for their current entity details pending the next quarterly update.10. International data transfers & safeguards
For providers with US parent companies (e.g. Microsoft, Google, Vercel, Groq, ElevenLabs, Deepgram, Cartesia, LiveKit, AWS), Famulor ensures compliance through:- Data residency: configuring services so data is processed exclusively on EU nodes wherever the provider offers it.
- Legal framework: use of the EU-U.S. Data Privacy Framework (DPF) and/or Standard Contractual Clauses (SCCs).
- Enterprise agreements: contracts that exclude third-party access and model-training use of your data.
- TIA on request: for enterprise customers, Famulor prepares a Transfer Impact Assessment (TIA) on request, per EDPB Recommendations 01/2020, for any provider with a US parent company.
Transfer legal basis per US-based provider
For providers without DPF certification, Famulor has executed the EU Standard Contractual Clauses under EU Commission Decision 2021/914/EU (Module 2: Controller to Processor). These are available to enterprise customers on request.
To independently verify a provider’s DPF certification: Data Privacy Framework Participants List
11. Data retention
Retention periods are available in your account and configurable per data category.12. Technical and organizational measures (TOMs)
Our security framework targets maximum traceability and isolation:13. Governance & maintenance
- This list is reviewed quarterly.
- Changes to the provider stack are documented in the Changelog.