Trust Center
Overview
Delivering trusted audio-native voice AI models and full conversation understanding with the Velma API throughout enterprise and regulated industries.
With over 600M hours of audio analyzed and 40M unique business risks detected, Modulate helps you build fraud prevention, AI agent guardrails, and IT security into your audio pipeline, and add best-in-class transcription with confidence.
Compliance
Certifications, audits, and standard agreements to ensure compliance.
SOC 2 Type II progress
- Step 1 Controls in place Complete
- Step 2 Independent audit Underway, Q4 2026
- Step 3 Report available on request Expected by January 2027
GDPR Compliance Overview
Modulate acts as the customer's Data Processor. Modulate provides API endpoints that process customer data at the customer's request and returns the results of that processing back to the customer. Customers determine the purpose of processing and are responsible for the lawful collection and use of their end users' data. The following is an overview of how Modulate handles customer data and allows customers to be compliant while using Modulate's services under standard service agreements. Specific agreements may modify the information provided in this overview.
This overview covers the use of Modulate's model endpoints to serve requests to process data and return results to customers. This does not cover the use of Modulate's website or web console interface (or associated web console interface APIs) used in configuring a customer's account settings, billing, credentials, and other customer account parameters. This overview differentiates between request data and response data, which is the data that the customer sends to Modulate for processing and the results of that processing that Modulate delivers respectively; and metadata, which includes the API endpoint that the customer sent the request to, the time that the request was received, identifiers associated with the customer's account, request content duration used for billing purposes, the feature flags associated with the request, and similar operational metadata.
Modulate processes data transiently, keeping no permanent record of request data or response data. Customer data and processing results are not retained beyond the lifetime of the processing request and are not included in any production logs or permanent data stores.
Modulate excludes customer data from training by default. Neither Modulate nor its subprocessors use customer content to train models.
Modulate provides EU-based API endpoints that perform request data processing on EU-hosted infrastructure. Request data and response data sent to EU-based API endpoints are processed on and returned from EU-based servers.
Metadata such as randomly-generated internal processing IDs, processing duration, content length and duration, API endpoint identifiers, request feature flags, and similar metadata specific to operational processing of the request are stored associated with the customer account and may be stored outside of the EU. Modulate provides assistance with metadata retrieval and deletion at the request of the customer. Modulate does not store any data that identifies specific end users of a customer's service or identifiers of end users, nor does Modulate provide to customers any mapping or identifiers that allows unambiguous correlation between Modulate-internal metadata and a customer's own metadata concerning its users.
Modulate's public API endpoints do not perform voice matching to uniquely identify or authenticate individuals.
Documents
View public documents right away. For anything else listed, contact us to send a request and we'll have a team member from our security team reach out to assist.
| Document | Category | Access | |
|---|---|---|---|
|
SOC 2 Type II report Available once the audit is complete, expected by January 2027. |
Compliance | In progress |
|
|
Privacy Policy and Velma Services Privacy Addendum How we collect, use, and protect personal data, including practices specific to Velma. |
Legal | Public | |
|
Velma Platform Terms of Service Terms for the Velma API and Modulate Platform. |
Legal | Public | |
|
ToxMod Terms of Service Terms for ToxMod voice moderation. |
Legal | Public | |
|
Subprocessor list Third parties that process customer data on our behalf. |
Legal | Public | |
|
Virtual Patent Marking Notice Patents covering Modulate products. |
Legal | Public | |
|
Data Management and Storage How Modulate manages, stores, and retains customer data. |
Security | Public | |
|
Data Processing Agreement Our standard DPA, including EU Standard Contractual Clauses and the UK Addendum. |
Legal | On request |
|
|
Business Associate Agreement Our standard BAA for customers processing protected health information. |
Legal | On request |
|
|
Security and Compliance overview Answers to common security review questions for the Modulate API Platform. |
Security | On request |
|
|
Penetration test summary Independent web application test of the Modulate API Platform, August 2026. |
Security | On request |
|
|
ISO 27001 certificate Certificate of registration covering ToxMod |
Compliance | On request |
|
|
kidSAFE COPPA certificate COPPA+ and SAFE seals certified for ToxMod |
Compliance | Public |
Security practices
The controls behind the Modulate API, Velma Platform, and ToxMod.
Infrastructure
- Services run in isolated virtual private clouds with security groups and network access controls
- Intrusion detection and continuous monitoring with AWS GuardDuty
- Redundant databases, regular backups, and failover
Data protection
- AES-256 encryption for stored data
- TLS encryption for all API and console traffic
- Most API endpoints never store your audio
Application security
- Independent penetration test every year, most recently August 2026
- Static code analysis and security review of source code
- API keys tied to unique accounts
People and access
- Least-privilege, role-based access, reviewed every six months
- Every request for access to customer data is logged and approved
- Background checks for all employees before hire
How we handle your audio
Voice data is sensitive. Here's where it goes and how long it stays.
Where it's processed
In the United States by default. Other regions can be arranged by agreement. EU and UK transfers are covered by Standard Contractual Clauses.
How long we keep it
Most developer API endpoints don't store audio at all. Features that do store audio keep it for 35 days, then delete it. Enterprise customers can set custom retention.
Model training
Enterprise customers can opt out of model training, and we can write zero training into your contract. Self-serve accounts are part of our Model Improvement Program. Audio uploaded to Velma Preview is never used for training.
Deleting your data
Delete audio and outputs any time through the dashboard or API. When a contract ends, we return or delete customer data and confirm deletion on request.
Contact
Reach the right team directly.