Trust and security
Brody security and trust. How Brody protects your data, your callers and your company.
Brody by Buildalytic handles calls and texts for construction companies worldwide. He identifies himself as an AI assistant, offers a path to your team and uses the recording, contact and sender registration rules agreed for your deployment. Your data stays yours.
For IT and security teams. Data ownership, staff access, tenant isolation, encryption, AI model handling and sub-processors, in full detail.
Read the security overviewAt a glance
What does Brody do on every call and text? He follows the rules and keeps your data yours.
Brody identifies himself as an AI assistant, uses the recording and contact rules agreed for your deployment and never sells your data. Country-specific sender registration and calling requirements are confirmed during setup.
AI disclosure on every call
Brody says who he works for and that he is an AI assistant, every time.
Recording consent
Notices and consent steps are agreed for the jurisdictions and callers in your deployment before recording is enabled.
TCPA consent for AI calls
Outbound AI campaigns only reach people with the right consent, inside calling windows.
Registered texting
Sender registration for the countries you use, including A2P 10DLC for applicable US local-number texting, plus opt outs and quiet hours.
Trusted caller ID
Caller ID attestation where supported, with your company name where carriers support it. Carrier spam labeling remains outside our control.
Your data stays yours
Never sold, never used to train models for other companies, encrypted in transit and at rest.
Calls
Will people know they are talking to an AI? Yes. Brody says so first.
Every call opens with who Brody is working for, that he is an AI assistant, and a recording notice where recording applies. Anyone can ask for a person, and Brody transfers the call or takes a message.
| AI disclosure | Brody opens every inbound and outbound call by naming the company he works for and saying he is an AI assistant. He never claims to be a person. |
| Recording notice | Recorded calls open with a notice. Brody records only where the consent rules for that call allow it. |
| Applicable consent rules | Recording is configured for your deployment. Before enabling it, your company and Buildalytic agree the notices, consent steps and handling of callers who decline, based on the locations and rules that apply. A phone number alone does not establish a caller’s location or consent. |
| Retention | Your company sets the recording retention period in its agreement and settings. Transcripts, reports, messages, attachments, consent records and audit logs have separate retention requirements. There is no single retention period for every record or provider. |
| Reaching a person | Anyone can ask Brody for a person. Calls transfer to your team or go to voicemail. |
| Fallback | If the AI or web service is down, calls fall back to a person or voicemail so your number keeps working. |
Outbound calls and texts
Do outbound AI calls need consent? Yes. Brody checks before he dials.
For US calls, the FCC ruled in 2024 (FCC 24-17) that AI generated voices count as artificial voices under the Telephone Consumer Protection Act. Outbound AI campaigns therefore need the right consent, clear opt outs and lawful calling windows.
- Outbound AI campaigns only to contacts with the right consent
- Opt out on any call or text, honored right away
- Calling windows and quiet hours by time zone
- Do not contact lists kept per company
Business texting
Is business texting registered? Yes. Each company has its own.
For applicable business texting from US local numbers, each customer company uses its own registered A2P 10DLC brand and campaign. Other countries have their own sender registration and carrier requirements, confirmed before activation. When someone replies STOP, they are opted out at once. Quiet hours apply to every message, and the signature on each text names your company.
Phone company duties
What does it take to replace our phone system? Country-specific requirements before your number moves.
Number availability, porting, caller ID, sender registration, consent and emergency calling are reviewed for each country before activation. The US examples below cover STIR/SHAKEN, E911, CPNI, A2P 10DLC and TCPA. They are not a description of the requirements in every country.
| Requirement | What it means | How Brody handles it |
|---|---|---|
| STIR/SHAKEN | Participating carriers sign and verify caller ID. Attestation does not guarantee that a call avoids spam labeling. | Calls from your company number carry caller ID attestation. Branded caller ID shows your company name where carriers support it. |
| E911, Kari's Law | Office phone systems must let anyone dial 911 directly, with no prefix, and notify a central point when they do. | For a supported US office line, direct 911 dialing and office notification are configured and tested before your main number moves. |
| E911, RAY BAUM'S Act | Each 911 call must send a dispatchable location, such as a street address and floor. | Each supported US office device needs a registered dispatchable location. Emergency calling availability, routing and testing are confirmed for every country and covered device before the line is used as an office phone. |
| CPNI | Call records and account details are customer proprietary network information that providers must protect. | Call records are restricted by role and never sold. Applicable US carrier and CPNI responsibilities are documented with the providers used for your deployment. |
| A2P 10DLC | Business texting from local numbers needs a registered brand and campaign. | A separate registration for each customer company, with opt outs honored at once. |
| TCPA | Calls and texts with artificial or AI voices need prior consent and opt outs. | Consent checked before outbound AI campaigns, with calling windows and opt outs on every contact. |
Your main number moves only after every porting check passes on your real setup, including 911 from every covered device and human fallback when the AI is down.
Data
Who owns our calls and records? You do. Always.
Your calls, texts, emails, documents and records belong to your company. We use them to run Brody for you and for nothing else.
Data ownership
Your records stay yours and can be exported at any time.
Never sold
We never sell, rent or share your data or your contacts for marketing.
No training for others
Your data is never used to train models for other companies.
Encryption
Data is encrypted in transit and at rest in every deployment mode.
Field photos
Photos crews text to your number are filed to the job, encrypted and kept as your records.
Private models
A private model is trained only on your data, and you own its weights.
Permissions
Knowledge base answers respect each person’s access to the source.
Labs stays separate
Buildalytic Labs never uses customer data. It builds from synthetic and expert written work.
Approvals and audit trail
You decide what Brody does alone. Everything else waits for a person.
Set rules in plain language for what Brody can do on his own and what needs approval from a PM, a super or the office. Every call, text, email and record change is logged on the job with who approved it and when.
- Approval steps by action and by person
- Full history of every action on the job
- Exportable logs for audits and disputes
Deployment
Where does Brody run? In our cloud, yours, or on your servers.
Choose the Buildalytic cloud, a private cloud for your company or local AI on your own servers. Worldwide service availability is separate from data residency. Our managed cloud is hosted in the United States, and each deployment documents its external providers and processing locations.
| Mode | What runs where | Price |
|---|---|---|
| Cloud | Everything, including the chatbot and knowledge base, in the Buildalytic cloud in the United States. | Included |
| Private cloud | A dedicated single tenant environment for your company with privately served models. | Separate Enterprise quote |
| Local AI | Local AI covers the agreed chatbot models, embeddings and document index on servers you own. Calls, texts, speech processing, connected services, support and backups can still use external providers unless your agreement explicitly replaces those paths. | Separate Enterprise quote |
Is our company data used to train AI models?
Not for anyone else. Your calls, texts, documents and records are never sold and never used to train models for other companies. If you buy a private model, it is trained only on your data and you own the model weights.
How does Brody handle call recording consent?
Recording is configured for your deployment. Before enabling it, your company and Buildalytic agree the notices, consent steps and handling of callers who decline, based on the locations and rules that apply. A phone number alone does not establish a caller’s location or consent.
Does Brody tell callers it is an AI?
Yes, on every call. Brody opens by saying who he is working for and that he is an AI assistant. He never pretends to be a person, and anyone can ask to reach someone on your team, so Brody transfers the call or takes a message.
How does Brody follow texting rules such as A2P 10DLC?
Sender registration and quiet hours are configured for the countries in your deployment. US local-number business texting uses the applicable A2P 10DLC brand and campaign registration. A STOP reply opts the recipient out of that messaging program.
Do outbound AI calls need consent under the TCPA?
Yes. For US calls, the FCC ruled in 2024 (FCC 24-17) that AI generated voices count as artificial voices under the TCPA. Brody only runs outbound AI campaigns to people with the right consent, honors opt outs and respects calling windows.
Who at Buildalytic can access our data?
Our security pack lists who on the Buildalytic team can access customer data and how that access is controlled. Inside your company, your admins decide who sees which records, and knowledge base answers respect each person's access. Call records are restricted by role, with applicable telecom privacy obligations reviewed for your deployment.
Where is Buildalytic's SOC 2 status and security documentation?
On our security page at buildalytic.com/security, which covers SOC 2, the controls we run today, staff access, encryption and sub-processors. Security teams get our security pack, a completed questionnaire and a security review before contract.
How do we request our security documentation?
Ask through the contact page and we send our security pack, including the current subprocessor list for hosting, phone carriers, speech and AI model providers. Enterprise buyers get it before the first meeting, and we answer security questionnaires directly.
Clear disclosure. Strict consent.
Bring your security questions.
Start a 14 day evaluation on one real project, and we will answer your security review alongside it.
One full Platform plan. No standard setup fee. Start with one supported workflow.
Plan your rollout
Pricing, security reviews, procurement and rollout across your projects and regions.