Where your data lives, and who can touch it
Support data is some of the most sensitive data a business holds: recordings of people's voices, addresses, booking references, complaints, occasionally a card number somebody read out loud. This page describes how Takallam is built to handle that — the architecture, the controls you get, and the things we deliberately do not claim.
Six things worth knowing before you read the rest
Data resident in the UAE
Workspaces run in me-central-1, the UAE region. Conversations, recordings, transcripts and knowledge bases stay in-region by default.
Encrypted in transit and at rest
Every connection to Takallam is encrypted with TLS. Stored data — including audio and transcripts — is encrypted at rest with AES-256.
Retention you control
You set how long recordings, transcripts and conversations are kept, per channel. Shorter is a valid answer, including zero for audio.
Roles, not shared logins
Every person on your team has their own account and a role that decides what they can open, export and change.
Not training data
Your conversations are not used to train models that are shared with anyone else. Your knowledge base is yours.
A short sub-processor list
Infrastructure, speech, language models, telephony. The current list is available on request, and it stays short on purpose.
It stays in the UAE because that is where it is created
Takallam runs in me-central-1, the UAE region. This is not a paid regional add-on or a setting somebody has to remember to switch on during onboarding — it is where a new workspace is created. For a lot of businesses here that is the difference between being able to use an AI support tool and not.
- Conversations, transcripts, call audio and knowledge base content are stored in-region.
- Backups stay in-region too. A backup in another jurisdiction is still data in another jurisdiction.
- If your organisation has a residency requirement in writing, send it to us and we will answer it line by line rather than pointing at a page.
- Arabic voice data is treated exactly the same as English — same region, same controls.
The short technical answer
Architecture and practice, described plainly. Takallam is pre-launch and holds no security certifications — see the FAQ below for exactly what that does and does not mean.
The safest record is the one you did not keep
Most support platforms keep everything forever because storage is cheap and nobody chose otherwise. Takallam makes retention an explicit decision. You set the window for each kind of data, and when it expires the data is deleted rather than archived somewhere quieter.
- Separate retention for call audio, transcripts, chat conversations and tickets — audio can be discarded immediately after a transcript is produced.
- Delete a knowledge source and it stops being used by your agents; you can see and remove every page and document Takallam learned from.
- Deleting a conversation removes it from the console, from search and from analytics — not just from the view.
- If you leave, you can export what you want and have the rest deleted. There is no hostage clause.
Who on your team can open what
Support teams turn over, and shared logins are how transcripts end up in places nobody can account for. Every person gets their own account and a role. The role decides what they can read, what they can export, and what they can change.
- Invite people individually, set their role, remove them the day they leave.
- Roles separate the person who answers conversations from the person who can change an agent, edit knowledge or export data.
- Sensitive actions — exporting conversations, changing retention, adding a team member — are recorded.
- Access on our side is limited to the people who need it for support and operations, and it is not a standing open door into your workspace.
What happens to a call after it ends
Voice is the part people ask about most, because a recording of a customer is a different kind of liability from a chat log.
Recordings
Recording is a choice, per channel, not a default you discover later. You can keep audio for a set window, or discard it as soon as the transcript exists and keep no audio at all.
Transcripts
Transcripts are what the console, tickets and analytics actually run on. They live under your retention setting, and they are searchable only inside your workspace by people with a role that allows it.
Redaction
Patterns that look like card numbers, national ID numbers and similar identifiers can be masked in transcripts so the sensitive part is never stored in readable form — including when a caller reads it out loud.
Sub-processors, and why the list is short
Any AI support platform depends on other companies. Pretending otherwise would be dishonest, and a vague answer here is usually a bad sign. These are the categories of sub-processor that can touch customer data when you use Takallam:
- Cloud infrastructure — compute, storage and databases in the UAE region.
- Speech — converting spoken audio to text, and generating the agent voice.
- Language models — generating the agent replies and summaries.
- Telephony — carrying inbound calls and providing phone numbers.
- Messaging delivery — sending the SMS or email a workflow triggers, when you use one.
How we handle them
The current list of named sub-processors is available on request before you sign anything, and workspace owners are notified before a new sub-processor starts handling customer data. Where a provider offers a no-retention or zero-data-retention mode for the content we send them, that is the mode Takallam uses.
We keep this list deliberately short. Every additional company in the path is another agreement to enforce, another region to check and another thing to tell you about later.
The formal version of all of this — what is collected, on what legal basis, and your rights over it — is in the privacy policy.
What we promise, and what we will not pretend
Your data is not training data
Your conversations, recordings, transcripts and knowledge base are not used to train models that are shared with other customers or the wider world. They are used to run your agents, produce your analytics, and improve your own workspace — nothing else. Your knowledge base does not leak into somebody else's agent.
What we do not claim
Takallam is not SOC 2, ISO 27001, HIPAA or PCI certified, and we are not going to put badges on this page that we have not earned. The platform is built to support those controls — residency, encryption, access control, retention, audit trails — and formal certification is planned work, not finished work. If your procurement process requires an attestation today, tell us early and we will tell you honestly where we stand.
The security questions we actually get
Where is our data stored?
In the UAE, in the me-central-1 region, by default. That includes conversations, call audio, transcripts, knowledge bases and backups.
Is Takallam SOC 2 or ISO 27001 certified?
No. Takallam is pre-launch and holds no security certification today, and we are not going to imply otherwise. What exists is the architecture those audits examine — in-region data, encryption in transit and at rest, role-based access, retention controls and logging of sensitive actions. Certification is planned work. If you need an attestation before you can buy, say so at the start of the conversation and we will be straight with you about timing.
Do you keep recordings of phone calls?
Only if you want them. Recording is a per-channel choice. You can keep audio for a defined window, or have it discarded as soon as a transcript is generated so no audio is stored at all.
Do you use our conversations to train your models?
No. Your conversations are not used to train models shared with other customers. They run your agents, feed your own analytics and improve your own workspace.
Who at Takallam can see our conversations?
Access is limited to the people who need it to operate and support the platform, and it is not an open door into your workspace. If you want a stricter arrangement written into your contract, ask — we would rather negotiate that than have you assume.
What happens if a customer reads out a card number?
Redaction can mask patterns that look like card numbers, national ID numbers and similar identifiers so they are not stored in readable form. Note the honest caveat: Takallam is not PCI certified and should not be treated as a payment environment. Take payments in your payment system, not in a support conversation.
Can we delete everything if we stop using Takallam?
Yes. Export what you need, then have the rest permanently deleted. Deletion means removed from the console, search, analytics and backups on the normal backup cycle — not hidden from the interface.
Who are your sub-processors?
Cloud infrastructure, speech-to-text and text-to-speech, language models, telephony, and message delivery. The current named list is available on request, and workspace owners are notified before a new sub-processor starts handling customer data.
Send us your security questionnaire
If your team has a review process, we would rather go through it before you commit than after. Send the questionnaire, or just the three questions you actually care about.
Data resident in the UAE · me-central-1 · retention you control