Security and trust
Verification records are evidence, so they have to be kept safe and kept intact. This page sets out how we protect them, where they are stored, who processes them for us, and how our AI phone agent behaves. Heimdell is evidence infrastructure, not legal advice.
How verification data is protected
Bank details are encrypted
Direct Debit account details are encrypted with AES-256-GCM before they are stored. The dashboard and certificates only ever show the last four digits of the account number.
No card numbers, no CVVs
Heimdell never collects a full card number or CVV. When you buy credits, the card payment is handled by Stripe, not by us.
Keys and links stored as hashes
API keys and customer verification links are stored as one-way hashes. A new API key is shown to you once and can't be read back, by you or by us.
Each company's data kept apart
Every dashboard page and API request is limited to the signed-in company's own records. Sellers only see the sales they submitted. Our database tables are closed to direct public access.
Sealed certificates
Each certificate carries a SHA-256 fingerprint of the evidence it records. If anything in the record were changed afterwards, the fingerprint would no longer match.
A full audit trail
Each consent step and each dashboard change is recorded with a timestamp. Entries are added, never edited. They are only removed if a client's whole account is deleted.
Signed webhooks
Every result we send to your system carries an HMAC-SHA256 signature, so your system can check it really came from Heimdell and wasn't changed on the way.
Recorded, identified calls
AI verification calls are recorded, and the customer is told so in the first sentence, along with the fact that they're speaking to an automated assistant.
Certifications
We are working towards ISO 27001 and SOC 2, with a target of the end of 2027. We will list each one here once it is awarded.
Hosting and where data lives
Application
The Heimdell application runs on a dedicated server hosted in the UK.
Database
Verification records, certificates and account data are stored in a managed database in the EU (Ireland).
Sub-processors
These are the companies that process personal data for us to run Heimdell. We don't sell personal data to anyone.
| Company | What they do for us | Location |
|---|---|---|
| Fasthosts | Hosting for the Heimdell application, and email delivery | UK |
| Supabase | Database hosting | EU (Ireland) |
| Twilio | Phone calls, call recordings and SMS | US / global, with UK GDPR-standard safeguards |
| Stripe | Payment processing for credits | US / global, with UK GDPR-standard safeguards |
| Anthropic | AI model for the phone verification agent and the dashboard assistants | US |
Full terms are in our Data Processing Agreement.
How long we keep records
Verification records and certificates are kept for as long as your account is active, because their whole purpose is to be evidence if a sale is disputed later. If an account is closed, we keep records for a reasonable period to meet legal and regulatory obligations, then delete them.
If your own record-keeping rules need a specific period, talk to us before you go live.
Call recordings are kept on the same basis as the certificate they belong to. To ask for records to be deleted, email contact@telecomcompliance.uk.
How our AI phone agent behaves
It says what it is
The first thing the customer hears is that the call is recorded and that they’re speaking to an automated verification assistant calling on your behalf.
It reads your approved wording
The agent reads the price, terms and policies from the template you approved. It doesn’t make up terms, prices or promises, and the whole call is recorded.
The customer stays in control
If the customer says something is wrong, or asks to stop, that is recorded as the outcome. They are never pushed to agree.
Calls that don't finish get a fallback
If a call doesn’t complete, the customer can be sent the verification link by text or email instead, and sales that still don’t complete can be flagged for a person to follow up.
We don’t use your customers’ data to train AI models.
Incidents and reporting a problem
If a security incident affects your data, we will tell you within 48 hours of becoming aware of it, with what happened, what data is involved and what we are doing about it. Where the law requires it, we also report to the Information Commissioner’s Office.
Found a security problem in Heimdell? Please email security@telecomcompliance.uk with the details. Please don’t test against other companies’ data or make your findings public before we have had a chance to fix them.
Documents
Doing a security review? Email contact@telecomcompliance.uk and tell us what you need.
Who you're dealing with
- Company
- Heimdell Tech Ai Ltd
- Company number
- 16478408 (registered in England and Wales)
- Registered office
- 11 Lower Croft, Preston, England, PR1 9DJ
- ICO registration
- ZC079121
- Contact
- contact@telecomcompliance.uk
Stop arguing about what was said.
Sign up in a couple of minutes. A real person reviews every application before it goes live, and you only pay for the verifications you send.