Security & Trust

How we run Sophia after-hours voice: disclosure, access, recordings, and what we will not claim.

Call Center Resources LLC DBA Lumina CX OS. Not a HIPAA badge. Not a SOC 2 report. Not an Enterprise SKU.

A2P brand & campaign verified SHAKEN/STIR approved Voice Integrity approved WI trademarks: Lumina CX OS, AI Ops Pro SOC 2 — not certified

What this page is

Public product is the after-hours inbound line. Security language follows that product — not a full CX platform bundle.

Encryption in transit (TLS 1.2+) and at rest
Role-based access and MFA on administrative users
US-based processing for the live line
We do not sell customer data
Sophia identifies as AI on the call
Emergency vs bookable is configured per account — not a promise of a live human on every call

Infrastructure

We do not name vendors on this page. Subprocessor list is available under NDA.

Voice AI + telephony with A2P, SHAKEN/STIR, and Voice Integrity on numbers we operate
CRM, workflows, and webhooks on CCR’s platform
Admin access: MFA and least privilege
No public claim of a specific model name or version

Compliance — facts vs review

Do not read this page as “HIPAA-ready,” “SOC 2 certified,” or “Enterprise included.” Those are not Core / Success / Pilot.

Data & recordings

Voice calls create audio, transcripts, and a written summary in CCR’s platform. That is the product.

Encryption in transit and at rest
Retention for recordings, transcripts, and CRM records — schedule in the DPA / order
Export or deletion on written request, subject to legal hold
We do not grant foundation-model trainers a right to use your calls unless the order says so
We are not a covered entity by default. A BAA exists only if both sides sign one

Access

Monitoring

Health checks on the live line. Not a public status page yet.

AI on the call

Sophia is an AI voice agent. We say so on the call.

AI disclosure at the start of the interaction
Emergency path is configured per shop — not “a human always picks up”
We do not hide synthetic voice
Prompts and routing for that account are set at kickoff and changed by us or the operator of record

Request the security packet

Questionnaire, DPA, insurance certificate, architecture under NDA, subprocessor list, SOC 2 status (not certified).

Subject: Security Packet Request – [Company]