Security & trust
Security you can check, not just take our word for.
Sortiva is listed on the Cloud Security Alliance STAR Registry and has signed the CSA AI Trustworthy Pledge. On every call it says it's an AI, asks before it records, hands over to a human on request and stays inside the guardrails you set. For how we handle personal data on this website, read our privacy policy.
We publish our security answers. All 283 of them.
Sortiva is listed on the Cloud Security Alliance STAR Registry at Level One, the global register security teams check before they buy cloud software. Our full CAIQ self-assessment, every control in the CSA Cloud Controls Matrix, is open for anyone to download. No NDA, no sales call, no waiting.
Passwords we can't read
Every password is salted and hashed with scrypt before it touches the database. Not even our own team can see it.
Session tokens a data leak can't use
Sign-in tokens are 256-bit random values kept in secure, HTTP-only cookies, and we store only their SHA-256 fingerprints.
Verified sign-ups
New accounts and password resets need a one-time email code. Codes expire, and five wrong tries kill them.
A bot with no Google password
Sortiva creates meetings through Google's official Meet API with OAuth. It never signs in as you and never stores your Google login.
Locked-down infrastructure
GitHub, hosting, cloud and Google admin accounts all require multi-factor sign-in, and every team laptop is fully disk-encrypted.
Backed up every night
The production database is backed up nightly and kept for 14 days, so your call history survives a bad day.
Committed to the CSA's standard for trustworthy AI.
Sortiva is a 2026 signatory of the AI Trustworthy Pledge from the Cloud Security Alliance, the non-profit behind the Cloud Controls Matrix and the STAR security registry. Signing commits us to four principles for building and running AI, and here is how each one shows up on your calls.
Safe and compliant systems
Sortiva stays inside the guardrails you set: approved pricing only, no promises it can't keep, and consent rules applied for each region.
Transparency
Every call opens by saying it's an AI. Leads know who they're talking to from the first sentence.
Ethical accountability
A human takes over whenever a lead asks, and the rules Sortiva follows are yours to set and change at any time.
Privacy protection
Recording starts only after the lead agrees, and call data is never used to train shared models.
Your brand is on every call. We act like it.
It always says it's an AI
Every call opens with a clear disclosure. Leads know who they're talking to from the first sentence.
Consent before recording
Recording and transcription start only after the lead agrees. Regional consent rules are applied automatically.
A human, on request
If a lead asks for a person, Sortiva books the next available rep or warm-transfers live, depending on your rules.
Guardrails you set
Approved pricing only. No discounts, no roadmap promises, no off-topic detours. Every boundary is configurable.
Your data stays yours
Encrypted in transit and at rest, regional data residency, and call data is never used to train shared models.
Built for admins
SSO, role-based access, audit logs on every config change, and retention policies down to the individual call.
Have a security review to run?
Our CAIQ answers are already public on the CSA STAR Registry. Send us your own questionnaire and we'll walk your security and legal teams through how Sortiva handles calls and data.