Security questions

The questions an IT or security lead asks first, answered in the open. Anything not here goes to security@proxara.ai.

Where it runs

Where does borrower data go?

To Proxara’s AWS, in a US region. A kept call’s words also go to a model in Microsoft’s US data zone, and its details to the officer’s email and any Monday board they connect. Nothing reaches your systems until you connect them.

Who else handles it?

Telnyx, which carries the calls and turns them into words on its own servers; Microsoft, which runs the model that reads a kept call and sends Proxara’s email; Amazon Web Services, which hosts Proxara; and Apple, which delivers its notifications. monday.com holds a board an officer connects. Sub-processors has the detail.

Does it record calls?

No audio is saved. Each person’s speech becomes words as it’s said, on Telnyx’s own servers, and Proxara never asks for a recording. If the officer keeps the call, its transcript, summary, details and notes stay until they delete it. If not, its words are erased.

What about the officer’s personal calls?

The people an officer chooses connect with nothing turned into words and no question. Any other call they don’t keep has its words erased.

Protection

How is the data protected?

TLS 1.2 or higher in transit, encrypted storage at rest with each call’s record sealed again under AES-⁠256, and every secret in AWS Secrets Manager. A Social Security number stays whole in one sealed place for 14 days, behind Face ID, and everywhere else keeps the last four digits.

Can Proxara see our data?

No screen at Proxara shows a call. Proxara’s operators can reach the stored data to run and repair the service, and no one else can. In an install in your own Azure, Proxara holds no account or role.

How long is anything kept?

A call the officer doesn’t keep: its words go at once, or 30 minutes after it ends if they don’t answer. A kept call: until they delete it or their account. A Social Security number: 14 days whole, then the last four digits. Logs of identifiers and counts: 30 days.

The model

Can the model get a figure wrong?

It can. Every item it keeps points at the words that said it, code keeps it only if those words were said, and one tap shows the officer those words. DU or LP judges the loan.

Is our data used to train a model?

Proxara trains no model on borrower data and uses it for nothing but the officer’s work. Microsoft’s terms say the same of the model that reads a kept call, and Telnyx’s bar training on calls except on de-identified data.

Does it make credit decisions?

No. The app doesn’t touch credit. In a connected install, DU or LP and your own people decide, and credit, DU and the disclosures run only on the officer’s yes. Proxara never produces an adverse action notice.

Operations

What if Proxara goes down?

A forwarded call reaches the officer through Telnyx and Proxara, with no second route, so it may not get through. Their phone company’s off code, *73 on Verizon, puts calls back on their phone.

Can anything run without the officer?

The app sends nothing to a borrower or an agent: the officer sends their own messages. It puts leads on their Monday board on its own, and each change can be undone. In a connected install, credit, DU and the disclosures never run without the officer’s yes, recorded with who, when and what they were shown, and no message goes out without it until the officer lets that kind go on its own.

What happens if we stop using Proxara?

Each officer turns forwarding off and deletes their account in the app, and everything Proxara holds for them goes at once. In a connected install, take the officers off the assistant and withdraw your grants. Thirty days later everything Proxara holds about their borrowers is deleted, and everything it wrote stays in your own Encompass, CRM and Outlook.

Compliance

Do you hold a SOC 2 report?

Not yet. The engineers who built it will take your security team’s questions on a call, and this Trust Center and the infrastructure code are open to your review.

How does it fit the FTC Safeguards Rule?

Element by element in FTC Safeguards Rule. The program stays yours, and Proxara is one service provider inside it.

Would you tell us about an incident?

Yes. Proxara tells the officer, and your named security contact where you’ve given one, without unreasonable delay once it discovers a breach of data it holds, and says what to do. Incident response has the steps.

What about the laws on recording calls?

Telling the people on a call is the officer’s, in their own greeting, under their own terms with Proxara. Proxara plays nothing on a call. Anyone who asks not to be recorded stops it for that call, and only that they asked and when is kept.