How P1 Desk protects every call
For public-sector and enterprise reviewers: how a call flows through the system, the controls on each hop, the rules we enforce per market, who processes data, and what we have not yet certified.
The path of one call
Left to right: where a call goes, and the control that applies at each hop. P1 Desk is the brain; the audio layer can be managed or your own.
المتصل
A phone call, or a test call from the browser
Audio recording is a per-business setting, with an optional spoken notice
الاتصالات الهاتفية
Twilio, your own carrier, or Exotel in India
Keep your existing number — it forwards to the agent
Voice orchestrator
Vapi (managed) or a stack you run yourself
Self-hosted stacks keep call audio on your own infrastructure
P1 Desk API
Agent spec, tool calls and event webhooks
Per-business secret, HMAC signatures, ±5-minute replay window, rate limits
قاعدة البيانات
Postgres (Supabase)
Row-level security per business, audit log, document text encrypted at rest
Your dashboard
Orders, bookings, calls and transcripts
Two-factor sign-in, team roles, retention you set
Your systems
POS, CRM, PMS or booking system
Signed outbound JSON, retried on a schedule, every delivery logged
Your customer
Confirmation by SMS or WhatsApp
Unguessable status link, never indexed, rate-limited
Encryption, isolation and audit
What the platform enforces today, for every business on every plan.
Tenant isolation
Row-level security scopes every database query to the business it belongs to. An unknown business id, a missing secret and a wrong secret all get the same 401.
Encryption
Traffic is served over HTTPS. Uploaded document text is encrypted at rest with pgcrypto. Vendor credentials and webhook secrets never leave the server.
Audit log
Price, availability, status, role and settings changes are recorded with who made them and when, readable by the business.
Verified webhooks
Inbound events must carry the business's own secret. HMAC-signed events must also arrive within a ±5-minute window, and a replayed signature is rejected.
Rate limits
Inbound webhooks, public status pages and the contact form are rate-limited per source, with documented limits.
Retention you control
Each business sets how long call data is kept — 30 days to 10 years. After that, personal details are redacted and messages deleted automatically.
Right to erasure
A business can erase everything held about one caller by phone number, or export and delete its whole account from Settings.
Sign-in security
Two-factor sign-in (TOTP) is available on every account, alongside magic-link sign-in and team roles for the people a business invites.
We do not use your data to train models, and we do not sell it. Personal-data breaches are notified without undue delay — within 72 hours where the law requires.
Outbound calls only inside the legal window
Campaigns dial in the called party's local time, inside these windows. Businesses may narrow a window, never widen it, and promotional calls go only to people who gave consent.
Permitted calling hours by market
Local time, 24-hour clock. Bars show when each kind of call may be placed.
- Promotional
- Transactional
| السوق | Promotional | Transactional | Consent for promotional calls | Registry / regime |
|---|---|---|---|---|
| Australia | 09:00–20:00 Mon, Tue, Wed, Thu, Fri, Sat | 09:00–20:00 | Required | DNCR |
| Brazil | 08:00–20:00 | 08:00–21:00 | Required | Procon Não Perturbe |
| Canada | 09:00–21:30 | 09:00–21:30 | Required | CRTC National DNCL |
| India | 09:00–21:00 | 09:00–21:00 | Required | TRAI TCCCPR (NCPR / DND) |
| Saudi Arabia | 09:00–21:00 | 09:00–21:00 | Required | CST |
| Singapore | 09:00–21:00 | 09:00–21:00 | Required | PDPC DNC Registry |
| United Arab Emirates | 09:00–21:00 | 09:00–21:00 | Required | TDRA |
| United Kingdom | 08:00–21:00 | 08:00–21:00 | Required | PECR / TPS |
| United States | 08:00–21:00 | 08:00–21:00 | Required | TCPA + National DNC |
| EU / EEA markets (8) | 08:00–21:00 | 08:00–21:00 | Required | ePrivacy opt-in |
| Other markets (18) | 09:00–20:00 | 08:00–21:00 | Required | Local do-not-call rules |
Rules are summaries for planning, kept in the product and enforced by the campaign runner; they are not legal advice. Your own obligations under local law still apply.
Your market's law, not a one-size policy
Each market in the registry carries its data-protection regime; the privacy policy shows visitors the rights section for theirs.
Markets by privacy regime
35 markets in total.
| Regime | Count | الأسواق |
|---|---|---|
| Local data-protection law | 15 | Australia, Bangladesh, Egypt, Indonesia, Israel, Kenya, Mexico, Nigeria, Pakistan, Philippines, South Africa, South Korea, Taiwan, Ukraine, Vietnam |
| GDPR / UK GDPR | 9 | France, Germany, Ireland, Italy, Netherlands, Poland, Portugal, Spain, United Kingdom |
| PDPA | 3 | Malaysia, Singapore, Thailand |
| PDPL | 3 | Saudi Arabia, Turkey, United Arab Emirates |
| APPI | 1 | Japan |
| CCPA / CPRA | 1 | United States |
| DPDP Act 2023 | 1 | India |
| LGPD | 1 | Brazil |
| PIPEDA | 1 | Canada |
- Local data-protection law15
Australia · Bangladesh · Egypt · Indonesia · Israel · Kenya · Mexico · Nigeria · Pakistan · Philippines · South Africa · South Korea · Taiwan · Ukraine · Vietnam
- GDPR / UK GDPR9
France · Germany · Ireland · Italy · Netherlands · Poland · Portugal · Spain · United Kingdom
- PDPA3
Malaysia · Singapore · Thailand
- PDPL3
Saudi Arabia · Turkey · United Arab Emirates
- APPI1
Japan
- CCPA / CPRA1
United States
- DPDP Act 20231
India
- LGPD1
Brazil
- PIPEDA1
Canada
Who touches the data, and when
Each vendor receives only what it needs. Where data leaves your country we rely on standard contractual clauses or equivalent safeguards; the regions for your deployment are set out in the DPA.
| Vendor | Purpose | Data it receives | Company based in | متى |
|---|---|---|---|---|
| Supabase | Database, authentication, file storage | All account, catalog and call data | United States | Always |
| Cloudflare | Hosting, edge network, rate limiting | Web requests | United States (global network) | Always |
| Vapi | Managed voice platform and its speech and model providers | Call audio, transcripts | United States | Managed voice stacks |
| Twilio | Telephony and SMS | Phone numbers, call routing, message text | United States | When a Twilio number or SMS is used |
| Meta (WhatsApp Business) | WhatsApp confirmations | Customer phone number, message text | United States | When a business connects WhatsApp |
| Stripe | Billing and payment links | Billing details; card data stays with Stripe | United States | Paid plans and pay-by-link orders |
| Resend | Transactional email | Email address, message content | United States | Invites, notifications, contact form |
| Lovable AI gateway | Document search embeddings and assistant parsing | Uploaded document text, assistant requests | Sweden | Knowledge documents and the assistant |
| Sarvam AI · Bolna AI · Exotel · Gnani AI | Indian voice stacks (speech, orchestration, telephony) | Call audio, transcripts | India | Only when a business in India chooses that stack |
| Google Fonts | Typefaces on public pages | Visitor IP address and browser details | United States | Public website |
Plus the endpoint each business sets for its own systems (Zapier, Make, n8n, a POS, PMS or CRM).
Choose where the audio runs
P1 Desk keeps the agent's brain — catalog, rules, records — while the audio pipeline can be a managed platform or a stack you operate in-country.
| Voice stack | Where the call audio runs | Speech | Typical latency | الأسواق | Set up by |
|---|---|---|---|---|---|
| VapiVapi | Managed by the vendor | Platform default | 500–800 ms | All markets | Self-serve |
| Vapi + Sarvam AISarvam AI | Managed by the vendor | Sarvam AI | 300–500 ms | India, Bangladesh | Self-serve |
| Bolna AIBolna AI | Managed by the vendor | Sarvam AI | 300–600 ms | India | Self-serve |
| Exotel AIExotel | Your infrastructure or operator | Platform default | < 500 ms | India | Operator-run |
| LiveKit + Sarvam AISelf-hosted | Your infrastructure or operator | Sarvam AI | < 300 ms | India | Operator-run |
| Exotel + Gnani AIGnani AI | Your infrastructure or operator | Platform default | < 500 ms | India | Enterprise contract |
Latency figures are the vendors' typical ranges, not measured guarantees. Every stack uses the same documented contract — see the integration docs.
What we have — and what we don't yet
We do not hold a SOC 2 report, an ISO 27001 certificate or a HIPAA attestation today. Planned items carry no date and are not certifications; this page changes when each one is complete.
In place today
- Data-processing agreement available on request
- Per-market privacy notice with the rights for each regime
- Breach notification without undue delay; within 72 hours where the law requires
- Per-market outbound calling rules enforced by the campaign runner
- Retention controls, per-caller erasure and full account export
Planned — not held today
- Independent penetration test, with a summary available under NDA Planned
- SOC 2 Type II audit Planned
- ISO/IEC 27001 certification Planned
- Customer-selectable data-residency regions Planned
Reviewing P1 Desk for a public body or an enterprise?
We answer security questionnaires, provide a data-processing agreement, and walk your team through the architecture and the deployment options above.