TRUST & SECURITY
Security across infrastructure, code and access.
Voz360 applies infrastructure- and application-code security controls alongside identity, privacy and operational review. This page explains the control areas and the evidence to discuss for your deployment. Security depends on the application, infrastructure, connected providers and the responsibilities agreed with your organization.
Last updated 25 October 2026Explore the review matrixInfrastructure: protect the environment behind the service
Infrastructure-level review covers network exposure, environment separation, administrative access, encryption, secrets and key ownership, operational monitoring, backups and recovery. Establish which controls are provided by the hosting environment, which are configured for Voz360 and which remain the customer's responsibility. Provider assurance applies only to its named scope; it does not automatically certify the application.
- Review access boundaries for production, administration and connected systems.
- Confirm transport and storage encryption and the handling of keys and secrets.
- Agree logging, recovery objectives, backup behavior and incident responsibilities.
Application code: verify the controls that handle each request
Code-level security addresses the behavior of the application itself: input validation, authentication, authorization, session handling, tenant/record access and protection of sensitive information. Use OWASP ASVS Level 2 as a structured verification reference, with a named version and evidence for the requirements within scope. A reference to ASVS is a testing baseline, not an OWASP certification.
- Check authorization on the server for the action and record being accessed.
- Validate incoming data and handle errors without exposing credentials or customer information.
- Review application and dependency changes through the secure development lifecycle.
Identity and access: MFA, roles and least privilege
The access-control review combines authentication, MFA enforcement scope and role-based permissions. Define the actions agents, supervisors and administrators require, the privileged paths that need stronger controls and the process for granting, changing and removing access. Test both allowed actions and attempts that should be rejected.
- Review MFA enrollment, enforcement, recovery and privileged-access requirements.
- Map roles and permissions to the teams and workflows in the deployment.
- Agree access reviews, account lifecycle responsibilities and audit coverage.
Secure SDLC, testing and vulnerability management
Security work should accompany design, development, release and operation. Review secure coding requirements, change review, automated checks and the ownership of findings. Penetration testing and vulnerability management answer different questions: an assessment explores an agreed attack surface, while ongoing vulnerability handling tracks issues, dependencies, remediation and retesting.
- Request the relevant testing scope and date rather than assuming a test covers every component.
- Review how findings are triaged, assigned and verified after remediation.
- Discuss dependency review, release approvals and production change controls.
Audit logging, monitoring and incident response
Auditability depends on useful events, restricted access and a review process. Confirm which authentication, administrative and data-access events are recorded, how long they are retained and how investigators can use them. Avoid unnecessary sensitive content in logs. Incident procedures should assign responsibility for detection, containment, investigation, notification and follow-up across the application and connected services.
- Define the event coverage and retention required for the service.
- Review access to logs and the operational monitoring process.
- Agree security and personal-data incident contacts in the relevant agreement.
Privacy, processing terms and customer responsibilities
Privacy review covers data purpose, access, retention, deletion, rights handling, subprocessors and international transfers. GDPR, DPDP and CCPA/CPRA apply according to the circumstances and applicable provisions. Use the Privacy Policy for website enquiries and the signed DPA for customer-service processing. An application control can support an obligation without replacing the organization's legal or operational responsibilities.
- Map the customer-service data and connected providers involved in your workflow.
- Agree the DPA, retention, deletion and transfer arrangements.
- Review cookie choices and notices for the actual website or application being used.
AI governance and payment-related scope
AI review should identify the authorized use cases, provider data flow, human review, retention and accountability for outputs. ISO/IEC 42001 is a management-system reference for that governance. Where payment information could enter a conversation, establish the intended payment flow and PCI DSS responsibilities before use. Do not submit payment-card data in website enquiries or assume voice recording is a payment-data control.
- Review AI assistance, routing, transcription and quality workflows separately where their data use differs.
- Agree provider restrictions and the review required before an AI output is used.
- Request the assessed payment-service scope and validation evidence where PCI DSS is relevant.
Frameworks, certifications and independent assurance
Voz360 confirms compliance alignment across the frameworks and controls listed below, including ISO/IEC 27001. Use the review matrix to define the evidence required for your deployment and procurement decision. Framework coverage and independent certification are different claims. Current certificate, report, test and scope information must be confirmed with the team. A SOC 2 report is an independent assurance report; ISO certification and PCI DSS validation have their own scopes and evidence.
- For ISO/IEC 27001, ISO/IEC 27701 and ISO/IEC 42001, confirm the current certificate, edition, issuing body, entity and scope if claimed.
- For SOC 2 Type I or Type II, confirm the issued report, auditor, system and date or review period.
- For penetration testing and PCI DSS, review applicable assessment evidence and customer/provider responsibilities.
FRAMEWORKS & CONTROL REVIEW
Ask for the evidence behind the scope.
These are review topics, not certification badges. Confirm current certificates, issued reports, assessment dates and the exact service scope before relying on an assurance claim.
GDPR
Data roles, lawful processing, individual rights, processor terms and international-transfer requirements for applicable processing.
Processing records, notices, executed DPA, transfer mechanism and rights-handling process.
DPDP
India's digital personal data protection framework, including notices, consent where required, rights and organizational duties as applicable provisions take effect.
Applicable notices, processing scope, consent records and grievance/rights workflow.
Privacy Policy
A readable explanation of website data collection, purposes, recipients, retention and available choices.
Current policy matched to the website and operating practices.
DPA
Controller/processor responsibilities, processing instructions, subprocessors, transfers, incidents and end-of-service handling.
The applicable executed data processing addendum and its schedules.
Cookie Consent
Clear storage information and a preference mechanism. Optional tracking must remain off unless a valid choice permits it.
Storage inventory, browser checks and the recorded preference version.
OWASP ASVS Level 2
A verification baseline for application controls such as authentication, authorization, session handling, validation and protection of data.
Versioned requirement mapping, test results, exceptions and remediation evidence.
Secure SDLC
Security requirements, review, testing and release controls throughout the software development lifecycle.
Development policy, review records, pipeline checks and release approvals.
Encryption
Protection of information in transit and at rest, with defined key ownership, access and lifecycle responsibilities.
Deployment configuration, key-management scope and validation results.
MFA
Additional authentication factors for relevant user and administrative access paths.
Enforcement scope, account enrollment, recovery and privileged-access settings.
RBAC
Role-based access and least privilege for service users, supervisors and administrators.
Role/permission matrix, access reviews and authorization tests.
Audit Logging
Relevant access and administrative activity recorded to support investigation and accountability.
Event coverage, access restrictions, retention and review responsibilities.
ISO/IEC 27001
Information-security management, risk treatment and ongoing review at organizational level.
A current certificate, issuing body, named legal entity and exact scope if certification is claimed.
ISO/IEC 27701
Privacy information management and accountability for processing personal information.
Applicable edition, certificate and processing scope if certification is claimed.
SOC 2 Type I
An independent SOC 2 report on the scoped system and the design of its controls at a specified date.
Issued report, auditor, scoped system, criteria and report date.
Penetration Testing
Targeted security assessment of the agreed application and infrastructure attack surface.
Assessor, scope, test date, findings, remediation and retest summary.
Vulnerability Management
Identification, triage, ownership and remediation tracking for vulnerabilities and dependencies.
Asset/dependency inventory, scan results, triage records and closure verification.
SOC 2 Type II
An independent SOC 2 report that includes operating effectiveness over a defined review period.
Issued report, auditor, scoped services, period and exceptions.
ISO/IEC 42001 (AI)
AI management, risk ownership, governance and review across relevant AI use cases.
Management scope, AI risk records and a current certificate if certification is claimed.
PCI DSS
Payment-data security requirements for the services and components within an assessed scope.
Current applicable AOC/ROC or other validation and the customer/provider responsibility matrix.
CCPA/CPRA
California privacy disclosures and applicable rights, including requests relating to sale, sharing and sensitive information.
Applicable notices, data-use inventory and verified request-handling process.
SECURITY QUESTIONS
Understand the scope behind the controls.
Are infrastructure security and application-code security the same?
No. Infrastructure controls protect the environment and its administrative and operational boundaries. Application controls govern how the software validates data, authenticates users, authorizes actions and protects records. Both must be reviewed with the actual deployment and connected services.
Does listing a standard mean Voz360 is certified?
No. A framework reference identifies a review topic. A certification or independent report must be supported by the current document, named entity, system scope and relevant date or period. Request the evidence applicable to your service evaluation.
How do we request a DPA or security review?
Use Contact Us and choose Security & compliance. Share your intended scope and the evidence you need, without including customer records or credentials. The team can coordinate the relevant technical and contractual review.
CONTINUE THE CONVERSATION
Bring your deployment and review requirements.
Tell us the services, controls and documents your team needs to evaluate.