Security and controls
A badge cannot answer a security review. A control can.
Zumu does not hold a security certification, so we are not going to show you one. Below are the voice AI security controls we actually operate, named, explained, and in several cases, built so you can check them yourself.
- Named controls, not a badge
- Keys encrypted, never stored in the open
- Webhook signatures you can check yourself
- No certification claims, ever
The control register
Thirteen controls, named one at a time
No score, no seal, no summary of a process you cannot see. This is what runs today, in the order an engineer would actually check it.
BYOK envelope encryption
Your own model, speech, and voice provider keys, if the database were ever read by someone who should not be reading it.
AES-256-GCM · ping-validated on save
Only the last four characters of a saved key ever render in the dashboard. The rest is not there to look at.
Per-organization scoping
One customer's provider keys, rate card, and calls from ever surfacing inside another customer's account.
Postgres RLS + org-scoped queries
Internal control, not outside-observable.
OAuth for the MCP server
Who is allowed to point an editor like Claude Code or Cursor at your call data and agent configuration.
RFC 7591 + PKCE · /oauth/authorize
Point Claude Code or Cursor at /mcp and read the consent screen yourself before you approve anything.
Two-party-consent barge-in gate
Callers in the states and countries where a third party joining a live call requires disclosure first.
Org-level consent acknowledgement
Try to turn barge-in on without the acknowledgement in place. It will not let you.
TCPA quiet hours by area code
The person being called, not the account placing the call, from outbound contact outside a reasonable window.
Callee-local window · area-code resolved
Load a contact whose area code sits outside the window and watch the job hold rather than dial.
Recording continues through transfers
The record of what actually happened on a call, including everything said after a human takes it over.
In-room transfer · recording never stops
Transfer a real call, then pull the recording afterward. The human leg is in it.
PII scrubbing on transcripts
A caller's Social Security number, card number, email address, or date of birth from sitting in a stored transcript.
Privacy-shield stage · pre-persistence
Internal control, not outside-observable.
Webhook HMAC signing and rotation
Whoever receives a Zumu webhook from acting on a payload that did not actually come from Zumu.
HMAC · X-Zumu-Signature · rotation overlap
Recompute the signature against your own endpoint secret and compare it to the header on the next delivery.
Delivery retry, dead-letter, and replay
An event from disappearing because your endpoint was down for a minute, mid-deploy, or briefly returning an error.
Retry · dead-letter · replay
Turn your endpoint off for a minute, then check the delivery log. The attempt is still sitting there.
Organization, project, and group hierarchy
Every account from a single flat list of members, which is not how a company with more than one team, brand, or region actually operates.
Org → project → group → role
Ask an administrator to open a project's member list and show you a role that only applies inside that one project.
Google and Microsoft SSO
Every login from resting on a Zumu-only password when your company already manages identity through Google Workspace or Microsoft.
Google OAuth · Microsoft OAuth
Open the sign-in screen and continue with your own Google or Microsoft account instead of setting a new password.
Granular RBAC with owner-role protection
A project from either too many people holding administrator access, or the specific failure of nobody holding it, which is what happens when the last owner is removed by accident.
Permission-key roles · last-owner guard
Try to remove the last owner from a project. The guard stops it before it happens.
Admin audit log
A security review from being a conversation about trust, by giving it a conversation about a record instead.
Admin-readable audit log
Ask an administrator to open the audit log and pull up the last role change on your own account.
Keys and encryption
What happens to a credential once you hand it to us
Your own provider keys, your organization's data, and the surface that reads both from outside the dashboard.
BYOK envelope encryption
Your own model, speech, and voice provider keys, if the database were ever read by someone who should not be reading it.
Every key is wrapped in AES-256-GCM envelope encryption before it reaches a table, and it is ping-tested against the real provider before it is ever saved, so a broken credential never sits in your account quietly failing calls.
Per-organization scoping
One customer's provider keys, rate card, and calls from ever surfacing inside another customer's account.
Every table carries row-level security tied to organization membership, with application-layer filters checked on top of it rather than a single query path that simply trusts the request it was handed.
OAuth for the MCP server
Who is allowed to point an editor like Claude Code or Cursor at your call data and agent configuration.
Registering a client runs through RFC 7591 dynamic client registration, every authorization is protected with PKCE, and a real consent screen is the only door in, the same shape as any other production OAuth server.
What a saved key looks like
••••••••••••••3f9c
AES-256-GCM envelope
ping-validated on save
Only the last four characters of a saved key ever render in the dashboard. The rest is not there to look at.
Call compliance
What happens on the call itself
Consent, timing, and the recording, handled as legal obligations rather than as settings nobody checks.
Two-party-consent barge-in gate
Callers in the states and countries where a third party joining a live call requires disclosure first.
Barge-in, the control that lets a supervisor speak directly into a live call, stays off until an organization records a consent-disclosure acknowledgement for two-party-consent jurisdictions.
TCPA quiet hours by area code
The person being called, not the account placing the call, from outbound contact outside a reasonable window.
Quiet hours default to nine in the morning through eight at night, computed from the callee's own local time by area code rather than the caller's, with an org-level override and a daily budget cap sitting underneath it.
Recording continues through transfers
The record of what actually happened on a call, including everything said after a human takes it over.
A transfer bridges a human into the same room the caller is already in instead of closing that room and starting a second one, so the recording and a supervisor's live listen-in continue straight through the handoff.
PII scrubbing on transcripts
A caller's Social Security number, card number, email address, or date of birth from sitting in a stored transcript.
A privacy-shield stage runs before anything is written to a knowledge base or a persisted transcript, scrubbing recognized identifiers and tracking what changed in a dedicated mapping table instead of deleting it without a trace.
What the consent gate logs
jurisdiction: two-party-consent · rule matched
barge-in: gated pending acknowledgement
Try to turn barge-in on without the acknowledgement in place. It will not let you.
Delivery integrity
What happens after the call, on the wire
A webhook is a promise that an event actually happened. These are the controls that keep that promise honest.
Webhook HMAC signing and rotation
Whoever receives a Zumu webhook from acting on a payload that did not actually come from Zumu.
Every delivery carries an HMAC signature in an X-Zumu-Signature header, and rotating the signing secret opens an overlap window instead of a hard cutover, so a rotation never quietly breaks verification mid-flight.
Delivery retry, dead-letter, and replay
An event from disappearing because your endpoint was down for a minute, mid-deploy, or briefly returning an error.
A failed delivery retries on a schedule, lands in a dead-letter queue if it never succeeds, and stays visible and replayable from the dashboard rather than being dropped after one attempt.
What a delivery receipt shows
X-Zumu-Signature: verified
attempt: logged · retry scheduled
replay: available from the dashboard
Turn your endpoint off for a minute, then check the delivery log. The attempt is still sitting there.
Access and governance
What happens inside the account itself
Who can see what, structured the way your company is actually structured, with a record kept of every change to it.
Organization, project, and group hierarchy
Every account from a single flat list of members, which is not how a company with more than one team, brand, or region actually operates.
An organization holds projects, each project scoped to its own agents, phone numbers, and data, and groups sit underneath both so a role can be handed to many people in one action instead of one at a time.
Google and Microsoft SSO
Every login from resting on a Zumu-only password when your company already manages identity through Google Workspace or Microsoft.
Sign-in supports Google OAuth and Microsoft OAuth alongside email and password, so who can get in is governed by the identity provider your IT team already runs.
Granular RBAC with owner-role protection
A project from either too many people holding administrator access, or the specific failure of nobody holding it, which is what happens when the last owner is removed by accident.
Roles are built from individual permission keys rather than a handful of fixed tiers, assignable at the organization level or scoped to a single project, and a guard blocks removing or deactivating the last owner of a project outright.
Admin audit log
A security review from being a conversation about trust, by giving it a conversation about a record instead.
Role changes, permission changes, and membership changes land in an audit log an administrator can open directly, not one that only engineering can query on request.
What the owner guard shows
remove owner: blocked · last owner on project
role: owner · scope: project
guard: checked before removal
Try to remove the last owner from a project. The guard stops it before it happens.
0
Certifications Zumu holds today. We are not going to bury that in a footnote or dress it up with language that implies otherwise.
The honest paragraph
We publish controls, not badges
We publish controls, not badges. A certification is a summary someone else wrote about a process you cannot see. A control is a specific thing you can ask an engineer about, and in a handful of cases above, check yourself against a real header or a real recording.
The list on this page is not a stand-in for a certification we do not have. It is what we run instead, and we would rather you read it and push back on it than take a logo at its word.
Where this fits
The rest of the trust story
- Keys
Bring your own model keys
The full BYOK story: encrypted per organization, validated on save, and routed per agent, including through your own gateway.
Model freedom - Delivery
The webhook system underneath control 08 and 09
Event types, payload shapes, signature verification code, and the delivery log, documented for whoever is wiring the receiving end.
Webhooks - Architecture
Where these controls sit in the system
The call layer, the agent runtime, the knowledge graph, and the operations surface these controls run inside, as one system rather than four.
Platform architecture
Questions
What security reviewers actually ask
Still have questions?
Send us your security questionnaire. We will answer it against the real controls, not a template.
Book a demo
Ask us about any control on this page, by number.
No sales deck about certifications we do not have. Bring a question about a specific key, a specific call, or a specific webhook, and we will walk through the control that actually handles it.
- No credit card for the demo
- Ask about any control by number