Clear roles. Traceable controls. No invented assurances.

Residency & encryption

Keep customer data within the agreed geography.

The database and queue operate in UK/EU regions, and the messaging carrier processes in the EU. Data is encrypted in transit throughout. Message bodies, voice transcripts, conversation summaries and uploaded CSVs receive field-level AES-256-GCM encryption.

Consent, opt-out & rights

Make a client’s choice immediate and durable.

The firm remains responsible for its lawful basis, client notices and instructions. Absolute Connect makes consent changes traceable and builds the operational response into the product.

• Immediate permanent opt-out: enforced at the database layer and not reversible by a future feature.
• Whole-message matching: an opt-out keyword is matched against the whole message, so “don’t stop, I need this sorted” is treated as the real message it is.
• Append-only evidence: every consent change is recorded to an append-only trail.
• Subject access: built tooling locates the client record and relevant conversation material.
• Erasure: empties the record, redacts every message and transcript, deletes the carrier’s recording, and keeps the opt-out honoured so re-import cannot re-enrol the client.

Retention & audit

Let the firm set retention. Keep the evidence fixed.

Retention is off until the firm switches it on, because the schedule must come from the firm’s own regulatory obligations rather than the platform’s guess.

• Every staff action is recorded with the action, time and responsible user.
• Approvals, sends, withholds, handoffs, administrative changes and support sessions are included.
• The audit trail is held for seven years.
• Neither the firm nor Absolute Tech Solutions can shorten that audit period.

Support access & logs

Absolute staff can look, with a reason, and cannot act.

Customer access is role-based. A support session is strictly read-only, requires a stated reason and is audited before it begins.

Sub-processors

Know which suppliers process customer data.

Every sub-processor is registered with its role, region and DPA state. Each firm can read the same live register inside its workspace at Settings → Privacy. Detailed supplier names, regions and DPA states are withheld from the public website and can be supplied during due diligence.

Voice is available on request while we complete provider due diligence.

Accessibility & dependencies

Test access structurally. Review every runtime dependency.

Accessibility is treated as an ongoing engineering requirement. The website targets WCAG 2.2 AA and is checked with structural tests, keyboard review, reflow checks and manual review; automated results alone are not a conformance claim.

The public website uses self-hosted fonts, styles and assets. The demo form posts only to Absolute Connect’s first-party application endpoint. Any future runtime service must be added to the integration inventory and reviewed for privacy, security, accessibility and performance before release.