Security, access and GDPR in the current Lera

Panel access is controlled through login or magic link depending on the prepared flow.

Roles separate superadmin from client and help each side see only what they should.

Only the data needed to operate the incident and preserve continuity is stored: the caller number, the text transcript and whatever the conversation produces.

It is better not to collect more than the trial or pilot actually needs.

Data at rest is hosted in the European Union. The application and database are in Germany, and encrypted backups in Amsterdam.

Part of the voice processing (transcribing, understanding, speaking) runs through providers outside the European Economic Area, with the safeguards the GDPR requires.

Voice data is deleted automatically, by default after 30 days. The deletion runs daily, with nothing to request.

The period can be shortened per agent if a specific case calls for it.

Audio recording is off by default. Audio is only stored if you turn it on for a specific agent.

When it is on, the agent always says a notice when it picks up, and the audio is deleted on the same schedule as everything else. We explain it in detail in the call recording article.

Security at this stage means avoiding weak access, broken configuration and unnecessary exposure of data.

It does not mean building a giant architecture before the product is validated.