Security at Contour.
Contour handles protected health information on every call. These are the controls around it.
Four controls on every call.
Every call runs inside the same four controls, whatever the workflow.
Encrypted
In transit and at rest. Calls, transcripts and records.
Access controlled
Role-based. Every action attributed to a person or an agent.
Audited
Every call, read and write logged and exportable.
Data protected
Your data stays yours. Never used to train models, never shared.
HIPAA compliant.SOC 2 Type 2 certified.
In detail.
What each control means in practice.
- Verification before PHI
- Callers are verified on the identifiers you configure before an agent shares any protected health information. Nothing is spoken before that point.
- Encryption
- Calls, transcripts, recordings and records are encrypted in transit and at rest.
- Access control
- Role-based access. Every read and write is attributed to a named person or agent.
- Audit logging
- Every call, read and write is logged with a timestamp and is exportable on request.
- Data use
- Your data is never used to train models and never shared. Retention follows the terms you set.
- Business Associate Agreement
- Executed before any PHI is handled.
- HIPAA
- Contour operates as a HIPAA-compliant business associate.
- SOC 2 Type 2
- Certified. The report is available under NDA on request.
- Review
- Every call is reviewable in Trace: what the agent heard, decided, read and wrote.
Questions.
Questions a security review asks first.
Yes, under NDA. Ask your Contour contact or write to [email protected].
In the regions agreed in your contract. Ask for the current infrastructure summary.
Only roles you grant. Every access is logged and attributed.
Yes. Every call, read and write is exportable on request.
Under the notification terms in your Business Associate Agreement.
Questions for our security team?
Write to [email protected] and we will route it to the right person.