What certifications does MeraTalk hold?

MeraTalk maintains SOC 2 Type II, PCI DSS Level 1, GDPR compliance, FCC 499 registration, and ISO 27001 certification. All certifications are audited annually by independent third parties with no tier restrictions — every plan receives the same compliance coverage.

How is my call data encrypted?

All data in transit is encrypted with TLS 1.3. Voice and media streams use SRTP (Secure Real-Time Transport Protocol). Data at rest is encrypted with AES-256. Encryption is applied at every layer — no unencrypted data leaves our infrastructure at any point.

Where is data stored and processed?

Data is stored in SOC 2 Type II certified data centers across the United States. For customers with data residency requirements, we offer region-locked storage configurations to ensure data never leaves a specified geography.

How does MeraTalk handle a security incident?

Our security team monitors for threats around the clock. In the event of an incident, we follow a documented Incident Response Plan: containment within one hour, customer notification within 24 hours, and a full post-incident report within 72 hours.

Can I run a penetration test against my MeraTalk environment?

Yes. Customers on Enterprise plans can request permission to run penetration tests against their dedicated environment. Tests must be coordinated with our security team in advance. We also share our most recent third-party penetration test summary on request.

Enterprise Security & Compliance

Security built in, not bolted on.

Every call, message, and data record on the platform is protected by end-to-end encryption, continuous threat monitoring, and a compliance framework that covers SOC 2 Type II, HIPAA, GDPR, and PCI DSS.

Start Free Trial Talk to Security Team

Security Operations

Monitoring · 24 / 7

ALL CLEAR

End-to-end encryption

···

Zero-trust verified

···

All layers protected

···

Live Activity

TLS 1.3 handshake establishedVERIFIED

SOC 2 checkpoint passedCOMPLIANT

Zero-trust policy evaluatedALLOWED

Compliance

SOC 2 Type II

PCI DSS

GDPR

ISO 27001

FCC 499

ENCRYPTION

Every byte encrypted. At every layer.

Encryption at the protocol, transport, and storage layer simultaneously — no unencrypted data ever leaves our custody.

TLS 1.3— Data in transit

AES-256— Data at rest

SRTP— Voice & media calls

ZRTP— End-to-end voice

Encryption stack

Application

HTTPS / WSS

TLS 1.3

Voice

SIP / RTP

SRTP + ZRTP

Storage

Block / Object

AES-256

Key Mgmt

HSM-backed

FIPS 140-2

Network

Internal SDN

IPSec

Infrastructure & access controls.

SOC 2 Data Centers

Biometric access · 24/7 guards

Our data centers are SOC 2 Type II certified with biometric entry, 24/7 on-site guards and CCTV monitoring. No unauthorized access — ever.

Geo-redundant Infrastructure

Auto-failover on site failure

Your data is replicated across geographically separated data centers. If one site goes down, traffic fails over automatically with zero manual intervention.

Threat Monitoring

SOC active around the clock

Our Security Operations Center monitors for intrusions, anomalies and DDoS events 24/7. Automated response kicks in within seconds of a detected threat.

Incident Response

Containment within 1 hour

A documented Incident Response Plan ensures containment within 1 hour, customer notification within 24 hours, and a full post-incident report within 72 hours.

Role-Based Access Control

Granular per-role permissions

Grant each team member exactly the access they need — nothing more. RBAC enforces least-privilege across every feature, dataset and API endpoint.

MFA & SSO

TOTP · Okta · Azure AD

Enforce multi-factor authentication for all users and connect your identity provider via SAML 2.0 — Okta, Azure AD, Google Workspace and more.

Audit Logs

12-month retention · exportable

Every admin action, login, permission change and API call is logged and retained for 12 months. Export to your SIEM or compliance platform any time.

API Key Management

Scoped · expiring · IP-locked

Generate API keys with fine-grained scope, expiry dates and IP allowlists. Rotate or revoke instantly from the dashboard — no deployment required.

COMPLIANCE BY INDUSTRY

Built for regulated industries.

Healthcare

HIPAA · BAAs available

PHI handling over voice & messaging

Financial Services

PCI DSS Level 1 · SOC 2 Type II

Call recording for MiFID II

Legal

Attorney-client privilege isolation

Chain-of-custody audit trails

Government

FedRAMP-aligned controls

US-only data residency available

Education

FERPA compliance

Data processing agreements

Retail & E-commerce

PCI DSS · GDPR · CCPA

Call recording with PCI pause/resume

Our Commitments

What we promise, every single day.

Security isn't a feature tier. These commitments apply to every account, every call, every byte.

End-to-end encryption, no exceptions.

TLS 1.3 in transit. AES-256 at rest. SRTP for every voice call. There is no opt-out and no unencrypted path.

Your data is yours. We never sell it.

We don't monetise call metadata, contact lists, or usage patterns. No third-party data brokers, ever.

Breach notification within 24 hours.

If a security incident affects your account, you hear from us first — before the press, before regulators.

Independent audits, published annually.

SOC 2 Type II reports are conducted by accredited third-party auditors. Summaries available under NDA on request.

Testimonials

What teams say after 90 days on the platform.

“Three vendors collapsed into one bill, and the AI receptionist booked $38k of consultations while we were closed. The platform paid for the year inside the first quarter.”

Multi-location dental practice

on consolidating the stack

“Inbound calls finally attach to the right deal. We attributed six figures of pipeline last quarter to calls that used to disappear into a generic queue.”

Mid-market insurance brokerage

on the HubSpot plugin

“Our outbound dialer's connect rate doubled inside two weeks. Lead prioritisation actually works when it runs against your live CRM, not a stale CSV.”

Staffing agency

on the AI Power Dialer

“Every after-hours call used to be a missed job — about $7k a month down the drain. The AI receptionist closed the gap in week one.”

Home services company

on the AI receptionist