Questions about BotNira?

BotNira uses multiple technical and organizational security controls, including SSL/TLS, encryption at rest, encryption in transit, two-factor authentication, firewalls, DDoS protection, backups, vulnerability scanning, penetration testing, access controls and incident response.

BotNira uses encryption mechanisms to protect information in transit and stored information.

Yes. BotNira performs regular vulnerability scanning and has completed penetration testing as part of its security program.

Access to BotNira systems is controlled according to security and operational requirements. Customer data is not routinely accessible to members of the BotNira team.

Yes. BotNira maintains a security response function for investigating and responding to security events and incidents.

BotNira maintains regional server environments for supported markets. Vendor data is stored and backed up in the designated region associated with the vendor's service environment.

Available regions include Canada, United States, European Union, United Kingdom, Australia and India.

Yes. Canadian vendor data is stored and backed up within the designated Canadian environment.

Yes. US vendor data is stored and backed up within the designated US environment.

Certain processing can involve third-party service providers or infrastructure outside the primary storage region.

In particular, AI processing through OpenAI can involve processing in the United States. Customers should review the applicable regional data-residency page for details.

Yes. BotNira uses AI technologies to provide automated communication, conversational and speech capabilities.

Yes. BotNira uses OpenAI API and business services as part of its AI processing architecture.

AI processing may take place in the United States because BotNira uses OpenAI services for applicable AI and speech processing.

This processing is separate from the regional storage and backup architecture described in BotNira's data-residency documentation.

No. Regional data residency primarily describes where applicable BotNira data is stored and backed up.

Certain third-party processing, including OpenAI AI processing, may occur outside the primary residency region.

Phone communications can involve Twilio as the telecommunications infrastructure provider.

The general architecture is:

Phone call → Twilio → BotNira → OpenAI speech/AI processing → BotNira → CRM/integration → storage.

Yes. WhatsApp communication involves Meta's infrastructure for message transmission.

BotNira then handles applicable processing and storage within its platform.

Email communication is handled through BotNira's services according to the applicable configuration.

Website chat is handled through BotNira services without an additional communication intermediary.

BotNira maintains documentation for SOC 2 Type II, ISO 27001, ISO 27701, GDPR-related compliance, HIPAA-related certification and penetration testing.

No. A certification or assessment does not by itself establish that every customer implementation satisfies all HIPAA requirements.

Specific healthcare use cases may require additional contractual, technical or organizational measures.

BotNira maintains GDPR-related compliance and privacy documentation and has implemented security and privacy controls relevant to protecting personal information.

GDPR compliance also depends on how a customer configures and uses the service and on the customer's own legal obligations.

BotNira maintains a Data Processing Agreement as part of its legal and compliance documentation.

Yes. Enterprise customers and prospective customers can contact the BotNira team for additional compliance, security or procurement documentation.

Data is retained while the vendor continues using BotNira.

When a vendor closes their BotNira account, applicable data is retained for 45 days and then permanently deleted.

Yes. While using BotNira, the vendor can manage and delete applicable customer data, calls and messages according to the available platform functionality.

After the vendor closes their account, BotNira retains applicable data for 45 days and then permanently deletes it, subject to any applicable legal or contractual requirements.

Depending on the communication channel and service functionality, BotNira may use providers including Twilio, OpenAI and Meta.

The specific role of each provider is described in the BotNira Subprocessors documentation.

No. Twilio primarily provides telecommunications infrastructure for applicable phone communication.

BotNira maintains its own storage and application infrastructure.

OpenAI is used for applicable AI and speech processing. Not every piece of BotNira data is necessarily sent to OpenAI.

BotNira provides legal documentation through the Legal section of the Trust Center.

Additional country-specific policies, agreements and legal documentation will be added as the program develops.