Trust Center
ThunderPhone is GDPR, HIPAA, and UK GDPR compliant. We document our controls, monitor them continuously, and enforce security policies across the platform.
Compliance frameworks
How ThunderPhone meets requirements for personal data, privacy, and protected health information.
GDPR
Sets requirements for handling and protecting personal data belonging to people in the European Union.
HIPAA
Sets U.S. safeguards for protected health information handled for healthcare customers and their patients.
UK GDPR
Sets requirements for handling and protecting personal data belonging to people in the United Kingdom.
Security controls
107 documented controls cover product, data, network, app, endpoint, and corporate security. Each is monitored continuously.
Product security
11 controls- Annual production console access review
- Need-based production database access
- Internet-restricted production database and SSH access
- Production customer database encryption at rest
Data security
27 controls- Role-specific security and privacy training
- Designated Information Security Officer
- Timely access removal after termination
- Malware protection on critical-access endpoints
Network security
1 control- Critical system network security guidelines
App security
5 controls- Multifactor authentication for critical systems
- Regular platform vulnerability scanning
- Automatic cloud session timeouts
- Password and secure login guidelines
Endpoint security
4 controls- Accountable infrastructure system inventory
- Endpoint security policy and controls
- Encryption of all critical endpoints
- Endpoint system inventory
Corporate security
59 controls- Documented business conduct standards
- Defined organizational authority and responsibilities
- Staff role and responsibility communications
- Qualified staffing for security roles
Security documents
40 policies and supporting documents are available on request. We review each request before sharing them.
Subprocessors
These vendors help us operate ThunderPhone. Each is covered by a data processing agreement.
Microsoft AzureCloud infrastructure
LiveKitCommunications infrastructure
TelnyxTelephony
GoogleCloud and artificial intelligence
StripePayments19 more subprocessors. See the full list in the DPA.