Talkie.ai Security & Trust Center

Talkie builds and operates AI Agents for healthcare. Our agents handle patient–clinic communication end-to-end—voice calls, web chat, and SMS—so patients get 24/7 access to care and busy practices never miss a conversation.

Our security controls are independently verified—through SOC 2 audits, third-party penetration tests, and GDPR audits. We meet HIPAA and GDPR requirements, as well as EU AI Act regulations.

Review the controls we maintain below, and request supporting documentation any time.

Request documentation

HIPAA, SOC 2, and GDPR

Talkie operates across two regulatory environments—US healthcare and EU data protection—and is audited against both.

  • HIPAA

    Talkie acts as a Business Associate to covered-entity clients and handles PHI accordingly.

    • Business Associate Agreements (BAAs) executed with US healthcare clients
    • Minimum-necessary standard applied to PHI access and use
    • BAAs in place with subprocessors that may process PHI 
    • Breach notification procedures aligned to HIPAA timelines

  • SOC 2 Type II

    Our controls have been examined by an independent CPA in 3 consecutive audits (April 2024, December 2024, July 2026.) 

    • All 5 Trust Services Criteria in scope: Security, Availability, Confidentiality, Processing Integrity, Privacy
    • Every report confirmed that controls are suitably designed and operating effectively


    Full report available—request by contacting     security@talkie.ai.

  • GDPR

    Our EU client base means GDPR is a requirement.

    • Purpose limitation, data minimization, and lawful-basis principles applied to data collection
    • Data Processing Agreements (DPAs) with clients and subprocessors, 
    • Defined data-subject rights handling (access, erasure, portability)
    • GDPR-compliant breach notification process to supervisory authorities where required

  • EU AI Act

    Talkie’s voice AI agents comply with the requirements of the EU AI Act.

    • Disclosure to users that they’re interacting with an AI agent
    • Human oversight maintained 
    • Ongoing regulatory monitoring enforced

Control Environment

Service infrastructure maintainedProduction environments run continuous anomaly detection; security event logs are reviewed.
Remote access MFA enforcedAdministrative and remote access to production systems requires multi-factor authentication and individually assigned credentials.
Remote access encryption enforcedAll access to production infrastructure goes over encrypted connections, using VPN and key-based authentication.
Data encrypted at restConfidential and highly-confidential data is encrypted at rest using AES-256.
Data encrypted in transitData in motion is protected with TLS 1.3 across production services.
Endpoint security enforcedCompany devices enforce full-disk encryption, password-protected login, and automatic screen lock.
Intrusion & anomaly monitoring implementedProduction networks and environments are continuously monitored for intrusions and anomalous activity.
Unique account authentication enforcedEveryone accesses systems with an individual account; shared logins are not permitted.

Employee and subcontractor selection and background checksNew hires and subcontractors go through a structured process — including multi-stage interviews, screening, and checks.
Password policy enforcedA central password policy sets minimum requirements across all company systems.
Security awareness training implementedEthics, cybersecurity, and privacy training is delivered during onboarding and repeated for all employees and subcontractors on a recurring basis.
Production inventory maintainedApplication data flows and production assets are documented and kept current.
Asset disposal procedures utilizedDevices and removable media are securely wiped clean before reuse or disposal.
Management roles and responsibilities definedSecurity ownership, reporting lines, and oversight responsibilities are clearly defined across leadership.
Security policies established and reviewedCompany policies, including the Code of Ethics and Anti-Fraud Policy, are documented, accessible, and reviewed annually.
Issue escalation channel establishedEmployees and subcontractors can escalate concerns, non-compliance, or suspected fraud through defined, open communication channels.

Vulnerabilities scanned and remediatedAutomated code and dependency scanning runs continuously, complemented by annual third-party penetration tests. Findings are tracked through to remediation.
Continuity and Disaster Recovery plans testedBusiness Continuity and Disaster Recovery plans are documented and exercised annually through a dedicated recovery drill.
Access reviews performedPermissions are reviewed on a recurring basis to confirm access remains appropriate to each person’s role.
Backup processes establishedCritical data is backed up on a defined schedule, with additional copies retained in a separate region.
Vendor management program establishedVendors are evaluated on technical fit, security, privacy, and financial stability before selection, and reassessed periodically thereafter.
Incident response policies establishedSecurity and privacy incidents are handled under a documented response process, with lessons learned folded back into the risk register.
Change management process enforcedChanges to infrastructure, data, and software move through design, testing, and formal approval before deployment.
Secure development lifecycle implementedSoftware moves through defined design, code review, testing stages, and sign-off steps.

Collection limitedPersonal data collection is scoped to defined, legitimate business purposes and documented in a data inventory.
Data classification enforcedData is classified into Public, Internal, Confidential, and Highly Confidential tiers, each with its own handling rules.
Data retention and removal enforcedRetention periods are defined by data category and reviewed periodically; data is securely disposed of once no longer needed.
Customer data deleted upon terminationSecure removal tools and documented disposal procedures apply once a customer’s data reaches the end of its retention period.
Data transmission controls for processorsPersonal data shared with vendors travels encrypted, and disclosures are limited to processors bound by a data processing agreement.
Data processing agreements executedEvery vendor that may touch personal data signs a data processing agreement and is risk-assessed before onboarding, with reassessment on a recurring basis.
AI processing permissions enforcedA permission matrix governs which data classification may reach which AI tool.
Data residency enforcedData residency is enforced per market: US client data is processed and stored within US regions, and EU client data stays within EU regions.

Talkie’s AI governance follows the four functions of the NIST AI Risk Management Framework.

GovernAccountability, decision rights, and data-use rules
AI governance policy establishedA dedicated AI policy governs how AI is used across our product, engineering, and workforce, with a cross-functional committee approving every AI tool before adoption.
AI data permission matrix enforcedWhich data may reach which AI tool is governed by data classification — the most sensitive data is restricted to the most tightly controlled routes.
AI vendor governance enforcedAI providers go through the standard vendor governance process, must hold a BAA/DPA matching the data they touch, and are contractually barred from training on Talkie or customer data.
MapSystem inventory, data flows, and third parties
AI system inventory maintainedEvery patient-facing AI capability is tracked in an AI System Inventory recording the data classes it touches, PHI exposure, and risk tier.
Sub-processor & data flow mapping maintainedData flows between AI capabilities and their underlying model, speech, and telephony sub-processors are documented per client, including where PHI enters and exits the chain.
MeasurePre- and post-deployment testing and monitoring
Pre-production AI evaluation performedMaterial prompt, model, or tool changes are evaluated against test datasets before release — including checks that assistants perform consistently across patient groups and stay within their clinical scope.
AI observability and drift monitoring implementedProduction AI calls emit versioned traces (model, provider, latency, cost), and aggregate agent performance is reviewed against baseline on a recurring cadence.
ManageGuardrails, change control, and incident response
AI change management enforcedPrompts, models, and provider configurations are version-controlled and follow the same review and rollout process as any software change.
Human-in-the-loop controls enforcedAI coding agents operate human-in-the-loop by default.
Voiceprint & biometric restriction enforcedNo tool in Talkie’s AI stack may generate a voiceprint or biometric template from a caller’s voice; only plain speech-to-text transcription is permitted — an absolute restriction.
Patient AI disclosure enforcedPatients are informed they’re interacting with an AI assistant and may request transfer to a human agent at any point. Required under the EU AI Act.
AI incident handling integratedAI-related security issues follow the standard incident response process; AI quality issues are routed separately for product review.

Security policies, procedures and registers

Every control traces back to a written, maintained policy. Summaries are available on request for enterprise security reviews.

Access Control Policy & Register
Information Classification & Labeling
Risk Strategy & Risk Register
Data Retention & Removal Policy
Incident Response Policy
Disaster Recovery Plan
Business Continuity Procedure
Vulnerability Detection Policy
Backup Policy
Vendor Governance Policy & Vendor Inventory
Software Development Lifecycle Policy
Change Management Policy
Service Monitoring Policy
Remote Work Policy
Mobile Devices Policy
Password Policy
AI Policy & AI Governance Framework
Code of Conduct and Ethics
Anti-Fraud Policy
Anti-Corruption Policy

Penetration testing

An independent external provider conducts penetration testing annually, on a rolling schedule. Findings are tracked through to remediation and reviewed by executive leadership as part of our quarterly and annual security reviews. Scope was expanded in the most recent cycle to explicitly cover three areas:

  1. 1

    Platform

    Web application and product-layer testing

  2. 2

    Network

    DMZ and perimeter infrastructure

  3. 3

    Infrastructure

    Full AWS cloud infrastructure audit

Great team and product

“Security measures, especially personal data protection, is of utmost importance at Talkie.ai. It’s important for our clients to be able securely integrate our systems and solutions with their platforms, encrypt data, and back up and store data to standards that meet and ideally exceed the requirements of the healthcare industry.”

Wojciech Przechodzeń
CPO, Talkie.ai

Need documentation for a security review?

Request our SOC 2 Type II report, BAA template, or pentest attestation letter—most are shared under NDA within 3 business days.

You can reach us by emailing security@talkie.ai or by submitting the form below.

Fill out the form

Frequently asked questions

  • Is Talkie HIPAA compliant?

    Yes. Talkie acts as a Business Associate to covered-entity clients and handles PHI accordingly. We execute a Business Associate Agreement (BAA) with every US healthcare client, and with any subprocessor that may process PHI.

  • Is Talkie SOC 2 audited?

    Yes. Our controls have been examined by an independent CPA across three SOC 2 Type II audits, covering all five Trust Services Criteria—Security, Availability, Confidentiality, Processing Integrity, and Privacy. Every report confirmed our controls are suitably designed and operating effectively.

  • Can I see your SOC 2 report and other documentation?

    Yes. Email security@talkie.ai to request the full SOC 2 report, penetration-test summary, and related documentation.

  • Where is our data stored, and is it encrypted?

    Talkie runs on Amazon Web Services, with data residency enforced per market—US client data is processed and stored in US regions, and EU client data stays in EU regions. Confidential and highly-confidential data is encrypted at rest using AES-256, and data in transit is protected with TLS 1.3 across production services.

  • Are patients told they’re speaking with an AI agent?

    Yes. Disclosure that a caller is interacting with an AI agent is built into how our agents operate, in line with EU AI Act transparency requirements.