Compliance Architecture

Built by sales operators who lived through 25 years of TCPA enforcement.

Compliance isn't a checkbox — it's how we stay in business. Every call RevenueOS makes is governed by a stack of rules, disclosures, and audit trails designed to keep you on the right side of regulators and plaintiff's attorneys.

TCPA Compliant Recording Disclosure Built In AI Identification Protocol PII Handling SOC 2 Type II in progress

Section 01

TCPA & DNC Scrubbing

The Telephone Consumer Protection Act and the National Do Not Call registry are the two biggest landmines in outbound sales calling. RevenueOS handles both at the routing layer — before a single dial happens.

Before any call is placed

National DNC Registry Scrubbing

Every number is checked against the FTC's National Do Not Call Registry within 30 days of call execution. Numbers on the national DNC list are blocked and logged — no exceptions, no overrides.

Internal suppression

Your DNC List, Honored

Your internal DNC and suppression lists are loaded into RevenueOS and applied before every call. We never call a number you've previously unsubscribed, regardless of any other consent.

Wireless number handling

Wireless Number ID Protocol

Under FCC rules, wireless numbers require express written consent for autodialed calls. RevenueOS checks wireless status via CNAM lookup and requires documented consent before routing autodialer calls to mobile lines.

Calling hours by timezone

Reasonable Hours Enforcement

All calls respect recipient timezone, restricted to 8am–9pm local time. Attempted calls outside that window are queued for the next valid window or surfaced to your team for manual handling. Timezone data is captured and logged per call record.


Section 02

Call Recording & Two-Party Consent

Call recording is a state-law minefield. Eleven states require all parties to consent before a call can be recorded — known as "two-party consent" or "all-party consent." RevenueOS handles per-state rules automatically.

All-party consent states — calls from/to these states require disclosure before recording

Two-Party Consent States

RevenueOS identifies the state of both caller and recipient via ANI and prefixes and routes recording consent accordingly.

California
Florida
Illinois
Maryland
Massachusetts
Michigan
Montana
Nevada
New Hampshire
Pennsylvania
Washington
Automated disclosure

Disclosure Injection at Call Start

Before any recording begins, an automated disclosure plays: "This call may be recorded for quality and training purposes." State-specific disclosure variants are loaded automatically. All disclosure timestamps are logged in the call record.

This call is being recorded for quality assurance and training purposes. Participation in this call constitutes consent to recording.
Recipient opt-out

Recording Opt-Out Flow

If a recipient says "don't record this" or "I don't consent," RevenueOS immediately stops recording, logs the opt-out, and continues the call without recording. The opt-out is tied to the call ID and retained in the audit trail.

Retention defaults

Recording Retention Policy

Recordings are retained for 90 days by default — adjustable to 30, 60, 90, or 180 days based on your retention requirements. After the retention window, recordings are permanently deleted. Deletion logs are maintained.

Storage & access

Transcripts & Audio Access

All recordings are transcribed and stored in an encrypted format. Only users with explicit role-based access can play back recordings or download transcripts. All access is logged.


Section 03

AI Disclosure Protocol

When a human asks if they're talking to a machine, RevenueOS answers honestly. Some states have passed laws requiring AI disclosure — we exceed those requirements by default, on every call.

What triggers disclosure

When the AI Identifies Itself

  • On request: If the recipient asks "are you a robot" or "is this an automated call," the agent responds directly and honestly
  • California SB 1001: Automated calls in California must disclose AI involvement. Our agent does this proactively for all California-originated calls
  • Texas & Florida: Additional AI disclosure rules are checked and applied per-call routing
  • Initiation disclosure: When a human handoff is requested, the AI confirms it's AI before connecting
Disclosure language

Sample Disclosure Language

RevenueOS AI agent uses the following disclosure when directly asked:

I'm an AI voice agent — not a human. I'm here to help you explore whether this conversation is worth your time. If you'd prefer to speak with a human, just say so and I'll connect you right away.
(California variant) This is an automated call made using artificial intelligence on behalf of [Company Name]. You may request to speak with a human representative at any time.

AI disclosure is not optional in RevenueOS — it's baked into the agent's instruction set. It cannot be disabled to "sound more human." Honesty is not a configuration option.


Section 04

Data Handling & PII

Every call generates data — phone numbers, transcripts, caller intent, disposition outcomes. RevenueOS treats all of it as PII unless proven otherwise.

Storage

Where Recordings & Transcripts Live

Call recordings and transcripts are stored in AES-256 encrypted volumes. Access is role-based and audited. Data is geographically stored in US regions by default; EU storage is available for organizations with EU-domiciled callers under separate agreement.

Encryption

At Rest & In Transit

  • At rest: AES-256 encryption on all stored data
  • In transit: TLS 1.2+ for all API calls, webhooks, and streaming audio
  • Key management: Rotating keys managed via cloud provider KMS (AWS KMS / GCP Cloud KMS)
  • Signal data: Audio streams use SRTP encryption during live calls
Retention

Retention Windows & Deletion

  • Recordings & transcripts: configurable 30–180 days, default 90 days
  • Call metadata (no audio): retained up to 2 years for audit purposes
  • Deletion on request: Subject access requests must be fulfilled within 72 hours. All audio, transcript, and metadata associated with the requesting phone number or email is deleted and a deletion receipt is logged
  • Manual deletion: available via admin interface or API at any time
Certifications

SOC 2 Type II & GDPR Posture

  • SOC 2 Type II: In progress — Type I report available upon request. Target audit completion: Q4 2026
  • GDPR: For any deployment touching EU residents, Data Processing Agreements (DPAs) are available. Legal basis for processing is legitimate interest or contractual necessity depending on call type. EU Representative available for EU-based data subjects
  • CCPA: Compliant — opt-out mechanisms for California residents, no sale of personal data
  • HIPAA: Available for healthcare-adjacent sales teams — BAA required, separate pricing applies

Section 05

Human Handoff Guardrails

When a lead qualifies and needs a human closer, RevenueOS bridges the conversation — not the liability. Context is transferred; sensitive data is not.

Context transfer

Silent Transfer Protocol

When a handoff is triggered, the human closer receives a briefing card: qualification outcome, stated pain points, budget range, timeline. Phone numbers, full names, and verbatim transcript excerpts are NOT included on the briefing card unless the recipient is pre-authorized.

Authorization gating

Role-Based Data Exposure

Closers without admin-level access see only the qualification summary, not raw recordings or full transcripts. Access tier is configurable per user role in your RevenueOS admin settings.

Audit trail

Transfer Logging

Every handoff logs: who received the transfer, what briefing data was delivered, timestamp of transfer, and whether the closer accessed the full recording. All transfer events are retained for 12 months.


Section 06

Audit Trail

Every RevenueOS call generates a structured log record that captures the entire compliance state of that call — from initial consent check through disposition. These records are exportable for internal audits, legal review, and regulatory examination.

Field Description Example Value
call_id Unique identifier for this call session ros-cx-2026-0525-8472
consent_status Was valid TCPA consent confirmed before dialing? consent_verified / consent_not_found / dnc_hit
dnc_check National DNC scrub result pass / blocked
disclosure_ts Timestamp when recording disclosure was played 2026-05-25T14:32:01Z
recording_consent State-level recording consent status all_party_consent_acknowledged / opt_out
ai_disclosure_given Was AI disclosure delivered (on request or staterequired)? true / false
agent_version AI agent model version used for this call ros-agent-v3.2.1
handoff_authorized Was handoff transfer authorized per data rules? true / false
retention_expires_at When this recording will be auto-deleted 2026-08-23T00:00:00Z
export_status Has this record been exported for legal review? not_exported / exported_at_ISO

Audit records are exportable in JSON and CSV formats via the RevenueOS Admin API. You can also trigger a full compliance export for any date range — useful for responding to TCPA litigation discovery requests or internal audits.


Have a specific compliance requirement?

TCPA counsel, state-specific disclosure questions, enterprise DPA, HIPAA BAA — we handle these routinely. Talk to us before you bid on a deal that has a compliance clause.

Talk to us