How ZyncoAI Handles Privacy, AI Disclosure, and Hosting

Most compliance pages are written to sound reassuring. This one is written to be accurate, which sometimes means saying "not yet" instead of implying "already done." If a specific certification or claim isn't true today, it's not on this page — and where a claim has a real, narrow scope rather than a broad one, that scope is stated exactly.

Does Ella tell callers they're talking to an AI?

Yes, on every call, not just if asked. Ella's opening greeting introduces her by name and by role, and that role always includes the word "AI" — an AI receptionist, an AI host, an AI service assistant, worded for whichever industry the business is in. If a caller asks directly whether they're speaking with a real person, Ella answers honestly every time — never denies it, deflects it, or claims to be human. That's a hard rule in how the call is built, not a style preference.

Where your data is actually stored

Your business's database and file storage — contacts, appointments, invoices, call recordings — are hosted in Sydney, Australia. That's a real, specific, checked claim, not marketing language: it's an enforced requirement, verified against the live database connection every time the platform checks its own compliance posture. It's also a scoped claim, not a blanket one: to answer a call in real time, the audio and transcript text pass through overseas AI providers — speech-to-text, the conversational AI model, and text-to-speech — and are carried by our telephony provider. Storage is Sydney-only; the real-time voice pipeline itself necessarily involves providers outside Australia, the same way almost any modern AI voice product's does. Saying otherwise would be the fabrication.

The Australian Privacy Act 1988

ZyncoAI is designed around the Australian Privacy Principles: only the data needed to run your front desk is collected, nothing is sold or shared with third parties, and every sensitive-record view, download, or send is written to an audit log your business can review. Compliance with the Privacy Act for how your specific business uses ZyncoAI is a shared responsibility, the same way it would be with any tool handling customer data — we'd recommend your own compliance process reviews your specific configuration rather than assuming a platform-level statement covers everything.

Certifications we don't have yet

ZyncoAI is not currently SOC 2 certified — that's on the roadmap as the platform scales, not a claim we make today. Data-handling practices are built around GDPR principles (data minimisation, purpose limitation, encryption), but that's a design philosophy, not a formal GDPR certification, and we don't present it as one. If a business specifically needs a formal certification we don't yet hold, the honest answer is that we don't hold it yet — not a reframing that implies otherwise.

Encryption and access controls, specifically

• Sensitive fields (Medicare numbers, private health details, and similar) are encrypted at rest before being written to the database.
• TLS is used in transit for every connection to the dashboard, API, and voice platform.
• Role-based access is enforced on every API route server-side, not just hidden in the interface — a Staff account can't see financial or payer data regardless of what the UI shows.

If something goes wrong

If a security issue affecting your data is identified, affected businesses are notified directly with a clear timeline and remediation — not left to find out independently. There's no public bug-bounty program running today; if you find a real issue, reporting it directly is the fastest way to get it looked at and fixed.