Built for teams that take data protection seriously
Convolink is designed around the UK GDPR, the Data Protection Act 2018 and the ICO's guidance on security. Here is how we keep your conversations safe.
UK data residency
Recordings, transcripts and account data are stored and processed in UK data centres. No international transfers are required for standard use.
Encryption everywhere
TLS 1.2+ in transit and AES-256 at rest. Secure session links can be password-protected and set to expire.
Access controls
Role-based permissions, SSO (SAML/OIDC) and mandatory two-factor authentication for admins on Business plans.
UK GDPR & Data Protection Act 2018
We act as a processor for customer content and a controller for account data. A signed DPA is available to all business customers.
Retention & deletion
Configurable retention periods. Deleted content is purged from live systems within 30 days and from backups within 90 days.
Continuous monitoring
Vulnerability scanning, dependency monitoring and independent penetration testing at least annually.
Reporting a vulnerability
If you believe you have found a security issue, please email security@convolink.co.uk. We acknowledge reports within 2 working days and do not pursue legal action against good-faith researchers.