Security, privacy, and compliance are not features.
They are how we built the platform.

Security integrated into every layer of the platform — not applied at the perimeter.

The Wemacx security architecture addresses protection at each layer of the platform independently — from the infrastructure that hosts the service, through the APIs that connect it to enterprise systems, to the AI services that process customer conversations, and the storage layers that retain interaction data.

Each layer carries its own security controls, its own audit trail, and its own access boundary. A breach at one layer does not cascade to others. This is not a perimeter security model — it is a defence-in-depth architecture where every component operates under the assumption that others may be compromised.

Security improvements are continuous. The platform undergoes regular internal security reviews, and findings are tracked through a formal remediation process. Customers are not required to take action to receive security improvements — they are applied at the platform level and take effect across all deployments.

Data in transit and data at rest — both protected, with no customer configuration required.

All web traffic between customers, agents, and the Wemacx platform is encrypted using TLS 1.3 — the current industry standard for transport security. This applies to browser sessions, API calls, webhook deliveries, and the agent desktop application. Unencrypted communication with the platform is not permitted.

VoIP signalling uses TLS 1.3 for SIP trunking via Session Border Controllers. WebRTC sessions are secured with DTLS for key exchange and SRTP for voice media encryption — ensuring that voice data in transit is protected end-to-end, from the browser or device through to the platform infrastructure.

Customer data stored on the Wemacx platform — including voice recordings, conversation transcripts, metadata, and customer records — is encrypted at rest. Encryption keys are managed within a dedicated key management infrastructure, isolated from the data they protect.

Defined retention periods — with full customer control.

By default, customer interaction data is retained for 90 days from the date of the interaction. After 90 days, interaction records are automatically and permanently deleted from the platform. This default applies to voice recordings, chat transcripts, AI-generated transcripts, and all associated conversation metadata.

Your data, in the region your regulatory obligations require.

By default, permanent customer data — including contact lists, call records, voice recordings, transcripts, and customer metadata — is stored securely in Mumbai, India. For organisations with data residency requirements, regulatory obligations, or latency considerations, regional hosting is available.

Cloud-agnostic architecture — deployed where your security and infrastructure policies require.

Wemacx is designed to operate across the major enterprise cloud platforms — AWS, Google Cloud Platform, and Oracle Cloud Infrastructure — as well as private cloud environments. This agnosticism is deliberate: enterprise infrastructure strategies vary, and the Wemacx platform should accommodate that variation rather than require customers to adapt to it.

Deployment model selection is made in consultation with the customer during the procurement and implementation process. Each model carries different implications for data residency, operational responsibility, and cost structure. Our implementation team works with customer IT and security teams to select the configuration that best meets their requirements.

Granular access control across every function of the platform.

Access within the Wemacx platform is governed by a role-based access control system that operates at multiple levels of the organisational hierarchy. Permissions are granted to roles, roles are assigned to users, and the scope of each permission is bounded by the organisational level at which it is granted.

Every administrative action, every access event — logged and auditable.

Operational transparency means that every significant event within the platform is recorded, timestamped, and accessible for review. Customers can investigate historical access events, configuration changes, and data access without raising a support request.

Platform infrastructure designed for the availability requirements of enterprise operations.

Customer engagement operations run continuously — often across time zones and outside standard business hours. The Wemacx platform infrastructure is designed with this in mind: high-availability architecture, automated failover, regular backup, and disaster recovery capability are operational requirements, not options.

AI that operates within boundaries your organisation defines — with humans able to review, override, and correct.

AI capabilities within Wemacx are not autonomous systems. They operate within customer-configured parameters, their outputs are subject to human review, and their behaviour can be adjusted, restricted, or overridden by authorised administrators. Enterprise AI governance is a design requirement, not an afterthought.

Security and compliance documentation available to enterprise customers on request.

Enterprise procurement, security review, and vendor due diligence processes require documentation that goes beyond what a public webpage can appropriately contain. Wemacx maintains a library of enterprise security and compliance documentation available to qualified customers and prospects under a Non-Disclosure Agreement.

To initiate a documentation request or formal security review, contact our enterprise security team. Requests are handled directly by our security and compliance team — not routed through a general support queue.