Compliance & Certifications
Frameworks and standards we adhere to
GDPR
ActiveFull compliance with EU General Data Protection Regulation
Swiss FADP
ActiveCompliant with Swiss Federal Act on Data Protection (revFADP 2023)
ISO 27001 Datacenter
ProviderInfrastructure hosted in ISO 27001 certified datacenters
EU AI Act
EvaluatingStandard AI system. Compliant with Art. 50 transparency obligations under the EU AI Act. Administrative routing tool — not clinical decision support.
SOC 2 Type II
ProviderThird-Party Voice AI Provider (EU) SOC 2 Type II certified and HIPAA compliant. Infrastructure provider ISO 27001 certified.
HIPAA (Provider)
ProviderThird-Party Voice AI Provider (EU) is HIPAA compliant with BAA. Zero-retention mode enabled for healthcare conversations.
Swissmedic CHRN (economic operator)
RegisteredExatoshi AG is registered with Swissmedic as an economic operator (CHRN-PR-20010601, CHE-266.634.159). A CHRN identifies the company in that role only: it is not a product registration, certification or approval, and it states nothing about the conformity of any individual product.
Software Quality Standards
InternalComprehensive conversation audit trails, routing accuracy monitoring, and quality assurance processes to ensure reliable appointment routing.
Security Documentation
Public reports and assessments
Privacy & Security Self-Assessment
Comprehensive overview of our security practices and controls (AS-2026-001)
Download PDFData Processing Agreement (DPA)
Standard DPA with EU SCCs for enterprise customers
Healthcare Security Architecture
Technical architecture for secure medical records and healthcare compliance
Download PDFSub-processors List
Complete list of authorized sub-processors with data transfer mechanisms
Security Policies
ISO 27001 Framework Alignment
All policies actively followed as part of our security program
| Policy | Category | Status |
|---|---|---|
| Data Protection Policy | Data Privacy | In Practice |
| Data Retention Policy | Data Privacy | In Practice |
| Information Classification and Handling Policy | Data Privacy | In Practice |
| Information Transfer Policy | Data Privacy | In Practice |
| Information Security Policy | Security | In Practice |
| Access Control Policy | Security | In Practice |
| Cryptographic Control and Encryption Policy | Security | In Practice |
| Cryptographic Key Management Policy | Security | In Practice |
| Network Security Management Policy | Security | In Practice |
| Physical and Environmental Security Policy | Security | In Practice |
| Malware and Antivirus Policy | Security | In Practice |
| Patch Management Policy | Security | In Practice |
| Asset Management Policy | Operations | In Practice |
| Change Management Policy | Operations | In Practice |
| Backup Policy | Operations | In Practice |
| Logging and Monitoring Policy | Operations | In Practice |
| Business Continuity Policy | Operations | In Practice |
| Incident Response and Evidence Collection Policy | Operations | In Practice |
| Secure Development Policy | Development | In Practice |
| Cloud Service Policy | Development | In Practice |
| Risk Management Policy | Governance | In Practice |
| Third Party Supplier Security Policy | Governance | In Practice |
| Continual Improvement Policy | Governance | In Practice |
| Document and Record Policy | Governance | In Practice |
| Intellectual Property Rights Policy | Governance | In Practice |
| Information Security Awareness and Training Policy | Personnel | In Practice |
| Acceptable Use Policy | Personnel | In Practice |
| Clear Desk and Clear Screen Policy | Personnel | In Practice |
| Mobile and Teleworking Policy | Personnel | In Practice |
29 policies aligned with ISO 27001:2022 framework
Product Security
Technical measures protecting your data
Encryption
TLS 1.3 in transit, AES-256-GCM at rest. Transcripts and sensitive data encrypted end-to-end.
Multi-Tenant Isolation
Complete data separation between customers with Row-Level Security.
Authentication
JWT-based auth with secure session management. OAuth 2.0 for integrations.
Audit Logging
Immutable audit trail for all actions, with configurable retention.
Backup & Recovery
Daily encrypted backups to Swiss-based storage with end-to-end encryption and zero-access architecture. Disaster recovery tested regularly.
Monitoring
24/7 infrastructure monitoring. Automated alerting for anomalies.
Webhook Security
All inbound webhooks verified via HMAC-SHA256 or JWT. No unauthenticated webhook endpoints.
Application Security
OWASP-aligned controls: SQL injection prevention, XSS protection, path traversal hardening, rate limiting.
PII Protection
Sensitive data masked in application logs. Email addresses automatically redacted.
Data Privacy
Your data, your control
Data Residency
All data hosted in Switzerland and EU. No transfers to third countries without explicit consent.
Data Retention
By default, AIAgens does not retain voice audio and conversation text beyond the duration of the interaction. Call recording and transcription are disabled by default. AIAgens operates with zero retention by default — voice and conversation data is processed in real-time and never stored. For medical plans, long-term retention (10-20 years, Art. 400 CO, FMH) is the doctor's responsibility as Controller. Data deleted upon request within 30 days.
Data Subject Rights
Full support for access, rectification, erasure, and portability requests.
Consent Management
Granular consent controls with complete audit trail of all consent changes.
Three granular consent types for medical deployments: call recording, routing data processing, and transcript storage.
AI Governance
Responsible AI by design
AI Disclosure
Every AI interaction clearly identifies itself as artificial intelligence. No deceptive practices.
Training Data
We do not use customer data to train AI models. Your data remains yours.
Human Oversight
Transfer to human agent always available. AI handles routine tasks, humans handle exceptions.
Bias Prevention
Regular audits of AI outputs to prevent discriminatory or harmful responses.
Subprocessors
Third parties that process data on our behalf
Last updated: February 2026
| Subprocessor | Purpose | Location | Security |
|---|---|---|---|
| Encrypted backup CH | Encrypted backup storage | CH (Switzerland) | E2E encryption; zero-access architecture; ISO 27001; Swiss jurisdiction |
| Secure medical email CH | Secure healthcare email (HIN SMTP) and identity authentication | CH (Switzerland) | S/MIME encryption (HIN-to-HIN automatic); OAuth 2.0 with PKCE |
| Telephony/SIP CH | Telephony / SIP trunk for voice calls | CH (Switzerland) | SIP over TLS; no call recording on their side |
| Transactional email CH | Transactional email delivery | CH (Switzerland) | TLS in transit; SOC 2 Type II; ISO 27001; EU region |
| Infrastructure hosting | Infrastructure hosting (dedicated servers, databases) | EU (Germany) | AES-256-GCM at rest; ISO 27001 certified |
| Voice AI Provider (EU) | AI voice processing (STT/TTS, real-time) | EU | No audio stored; EU data residency; SOC 2 Type II; ISO 27001 |
| AI language processing | AI language model for conversation intelligence | EU | Zero-retention API; no training on customer data; EU endpoint |
| Payments | Payment processing and subscription management | EU (Ireland) | PCI-DSS Level 1; SOC 2 Type II; EU acquiring |
| Calendar/OAuth | Calendar integration, OAuth authentication | EU (Belgium / Netherlands) | OAuth tokens encrypted; ISO 27001 / SOC 2; EU data region |
The complete list with the legal names of each sub-processor is available on request, under a signed NDA: contact dpo@aiagens.ch.
Google Calendar & Swiss Regulations
How we ensure compliance when integrating with third-party services
Data Privacy Framework
Since September 2024, Switzerland recognizes the Swiss-US DPF. Google is DPF certified.
EU Data Residency
We configure all accounts with EU (Belgium) data residency. Data never leaves the EU.
E2E Encryption
Medical notes encrypted with doctor's public key. Only they can decrypt.
Zero-Knowledge Medical Notes
We go beyond legal requirements. Medical notes collected by the AI are encrypted with RSA-2048 + AES-256-GCM before saving to Google Calendar. Neither Google nor AIAgens can read the plaintext - only the doctor with their private key and PIN.
Private key never leaves doctor's device
Security Contact
For security inquiries or to report vulnerabilities, contact our security team.
security@aiagens.chSecurity matters receive a priority response.