Trust & compliance.

Straight answers about our certifications, security posture, and the claims we make on this site.

Last updated: 2026-06-14

Certification Status

Framework	Status	Notes
SOC 2 Type I	In progress	Readiness program — internal controls + policy authoring. Auditor engagement pending; Type I report not yet started.
SOC 2 Type II	Planned	12-month observation window begins after Type I. Target: 2027.
HIPAA	HIPAA-ready design	Architecture supports BAA; BAA available on request for healthcare verticals. Not a certification.
GDPR / EU AI Act	Vendor DPAs in execution	Targeting completion in Q3 2026. Subprocessor list available on request.
CCPA	Compliant	Privacy policy + DSAR process in place.
TCPA	Compliant	Consent capture + STOP handling on all SMS/voice flows.

We will not claim certifications we do not hold. If a page on this site says "SOC 2" without a qualifier, report it: trust@bizbottech.com.

Claims & Statistics Disclosure

Per our internal policy, we do not publish social proof or performance statistics that we cannot verify. Claims you may see elsewhere on this site are governed by the following rules:

Customer counts — only published once audited against Stripe + provisioning records. If a number is missing, it is because we have chosen accuracy over marketing.
ROI figures (e.g., "30–50% fewer no-shows", "recovered revenue per month") — presented as industry-typical ranges with source or as illustrative examples inside interactive calculators. Not customer-specific outcomes unless explicitly attributed.
Timing claims (e.g., "paid in seconds") — presented as demo simulations or typical ranges, not guarantees.
Testimonials — only real, attributed customers with permission on file.

Data Handling

What we collect

Business contact info, call/chat transcripts (for the features you enable), billing data via Stripe. See the Privacy Policy for the full list.

Where it lives

Primary: US-region Vercel + Supabase/Postgres. Voice: Retell AI + Twilio. Email: Brevo + Resend. Model inference: Anthropic (Claude). Subprocessor list available on request.

Encryption

TLS 1.2+ in transit; AES-256 at rest on managed services. Secrets stored in Vercel environment variables; no secrets checked into source.

Retention & deletion

Customer data deleted within 30 days of account closure on request. Port-out available via one-click export.

AI training

We do not share, sell, or use your conversations to train third-party models. Anthropic's API terms prohibit training on our customer data.

Security Practices

Role-based access control; principle of least privilege on all production systems.
Prompt-injection sanitization on all LLM endpoints (see api/lib/claude.js).
Webhook signature verification on Stripe, Twilio, Retell.
Rate limiting + CAPTCHA on public forms.
Incident disclosure: material security incidents disclosed to affected customers within 72 hours.

Contact

Questions, concerns, or want to report a claim on this site you believe is unsubstantiated?

Trust & compliance: trust@bizbottech.com
Security disclosures: security@bizbottech.com
DPA / subprocessor requests: legal@bizbottech.com

BizBot Technology LLC · San Diego, CA · Privacy · Terms