English
Español
Português
Security and data protection at Icana.AI
CallCoach AI and Chat Analysis are built for Australian regulated environments. This page explains how we handle data residency, storage and privacy. It also covers the compliance frameworks our customers work within.
Data residency and sovereignty
Starter and Team customers can choose the geographic zone where data is stored: Australia, the United States, the European Union, Brazil or Mexico. Business and Enterprise customers have customisable region selection.
Not all Australian-hosted AI is the same. On standard plans, data is stored in the region you select but sent through global infrastructure. If you need more, our Enterprise offering keeps data in transit within Australia. Every recording, transcript and insight is processed and sent entirely within Australian infrastructure, in transit and at rest.
If you work under APRA, ASIC or health privacy frameworks, "stored locally" and "never leaves Australia" are very different. One can leave you exposed. If full data-in-transit residency matters to your review, it is available as an Enterprise feature.
What we store, and what we don't
We take your data security and data residency seriously. What we keep depends on how calls reach us and which plan you are on.
If you upload calls to us, your calls and transcripts are stored for 7 days and then deleted automatically. You choose the geographic zone where that data is stored.
If you use our integration with your call centre software, we do not store your calls or transcripts at all. CallCoach streams the recordings from your own cloud storage (AWS S3, Azure Blob or Google Cloud Storage) and analyses them without keeping a copy. The only place recordings are stored at rest is your own cloud storage.
Feedback reports (the output of CallCoach's analysis) are stored in our database in Australia. On a Business or Enterprise plan, you can choose the storage region.
We do not store recordings or transcripts of calls for our CallCoach product. We do not store personal data from chat conversations analysed by the Chat Analysis extension. We designed CallCoach from the start with privacy and personally identifiable information in mind.
We only work with Large Language Model providers that are strongly committed to privacy and security. They guarantee that data is used only to provide the service to our clients. Our customers' data is not used to train the models.
Privacy
We handle personal information in line with the Australian Privacy Principles (APPs) contained in the Privacy Act 1988 (Cth). Our privacy policy explains in full how we collect, use and protect personal information.
Call recordings capture live customer conversations, so we treat them with care. We design our storage, access and retention to keep that exposure as small as possible.
Compliance framework support
CallCoach supports your team in meeting the frameworks below. It is a quality-monitoring and evidence tool. It does not replace your own controls.
COPC CX Standard
CallCoach supports operations working to the COPC CX Standard. It gives full Transaction Monitoring coverage of every interaction. It also gives consistent, attribute-level scoring that you can use as the reference for the calibration sessions the standard expects. This includes Release 8.0, which baseline assessments have used since May 2026. All recertifications follow from January 2027.
PCI DSS
For contact centres that handle card payments, CallCoach supports PCI DSS monitoring with regional data hosting options, role-based access and no third-party data sharing. CallCoach complements a PCI-compliant recording platform. It does not replace pause/resume recording controls.
APRA and other regulators
CallCoach is built to support the information security requirements of APRA-regulated customers. It helps APRA-regulated contact centres in banking, insurance and superannuation meet conduct and disclosure obligations. Configurable scoring criteria also support teams working under ASIC, the OAIC and sector-specific frameworks.
CallCoach supports your team in meeting these frameworks. Icana.AI is not a certifying body and does not claim COPC or PCI DSS certification on your behalf. Terms such as Transaction Monitoring, CSS and KCRP belong to the COPC CX Standard. Icana.AI is not affiliated with COPC Inc. and does not award certification.
Who we are
Icana.AI is a registered business name of MoreTime Pty Ltd, an Australian company. You can verify our details on the Australian Business Register (ABN 23 656 757 201).
For procurement and AI-governance reviewers
If your legal, compliance or AI-committee review needs more detail than this page gives, we are happy to help. Tell us about your industry, your data-residency requirements and the framework you report against. We will reply with the detail your review needs.
Innovation that works
We use AI to help call centres improve every interaction and plan with data.
Set up in days, not months. Your first calls analysed free.