Your data stays with us
Your phone system runs on software we build ourselves, on servers we own, in our own data center at an undisclosed location in Fort Worth, Texas. We don't rent your phone system from a big cloud provider.
Backups are kept in cold storage in other parts of the United States and are only brought online if the primary data center fails. Customer data, including AI processing, stays in the United States. We never sell your data.
What's encrypted
Calls are encrypted, both the call setup and the audio, when you use:
- Cannon Certified phones: VoIP-6, VoIP-12 and VoIP-1
- The VoIP-ATA-1 adapter, from the adapter to our servers
- The Cannon VoIP mobile app, desktop app and web app
Other phones may not be. We support many other phone models so you can keep the hardware you have, but supporting a phone doesn't mean it's encrypted. Many older or third-party phones can't encrypt calls, or need settings we can't guarantee. If encryption matters to you, use Cannon Certified phones or our apps.
Calls to outside numbers. Calls between your team stay on our encrypted network. When you call someone on another carrier, the call is encrypted until it leaves our network. After that, it travels over the public phone network, which no provider can encrypt end to end.
We tell you first
If we receive a subpoena, court order or other legal demand for your data, we notify your account administrators within two business days. We then wait at least 14 days before responding, or until the legal deadline if it comes sooner, so you have time to object or get a lawyer. If you tell us you are challenging it, we hold off as long as the law allows.
The only exceptions are when a law or court order forbids us from telling you, or when there is an emergency involving risk of death or serious injury. If we are barred from telling you, we notify you once the law allows.
Your conversations stay private in lawsuits
We never give the contents of your calls, voicemails, recordings or texts to anyone in a private lawsuit without your consent. Federal law doesn't allow it.
We read every request. We only respond to valid legal process, and we ask for it to be narrowed when it asks for more than it should.
Your data isn't used to train AI
Your data is stored in our own data center in Fort Worth. When you use AI features like the AI receptionist or transcription, only what that feature needs is sent to our AI processing partners, processed, and sent right back. They do not keep or store it, and they have agreed not to train their models on it.
HIPAA mode lets you turn AI processing off entirely.
We verify it's you
Before our team discusses or changes your account, the caller must give a support code generated from their desk phone or the portal, plus other account details. This also meets the FCC's rules on protecting customer account records.
Your own logins support two-factor sign-in, and admins can require it for everyone.
You decide how long we keep it
Call recording is on by default, so you always have a record. You can turn it off for any number or extension, and off on an extension always wins.
Recordings, voicemails and faxes are kept for the periods you set in the portal, and we do not keep them longer than you choose unless a court order or legal preservation request requires it. Call logs are kept as long as the law and billing require.
When service ends, you have 30 days to export everything. After that your data is deleted, except the account, billing and tax records the law makes us keep, and deleted data ages out of our backups within 90 days.
If something goes wrong
If we confirm a security incident affecting your data, we notify you within 72 hours of confirming it, and notify regulators as the law requires. Independent penetration tests are run against our platform on a regular schedule. More on our security testing.
Some data passes through partners
To connect calls and texts to the outside world, we use phone carriers, and they keep their own records under their own policies. Our Privacy Policy lists every category of partner we use.
A Data Processing Addendum and a HIPAA Business Associate Agreement are available on request.
This page summarizes our practices. The binding terms are in our Terms and Conditions, including the Privacy Policy. Law enforcement and attorneys can send legal process through our law enforcement request form.
Common questions
Do you notify us if you get a subpoena for our data?
Yes. We notify your account administrators within two business days and wait at least 14 days before responding, or until the legal deadline if it comes sooner, so you have time to object. The only exceptions are when a law or court order forbids us from telling you, or an emergency involving risk of death or serious injury. If we are barred from telling you, we notify you once the law allows.
Are all calls encrypted?
Calls are encrypted, both the call setup and the audio, on Cannon Certified phones (VoIP-6, VoIP-12 and VoIP-1), on the VoIP-ATA-1 adapter from the adapter to our servers, and on the Cannon VoIP mobile, desktop and web apps. Other supported phones may not support encryption. Calls to numbers on other carriers are encrypted until they leave our network.
Where is our data stored?
On our own servers in our own data center at an undisclosed location in Fort Worth, Texas. Backups are kept in cold storage in other parts of the United States and are only brought online if the primary data center fails. Customer data, including AI processing, stays in the US.
Is our data used to train AI?
No. When you use AI features, what the feature needs is sent to our AI processing partners, processed, and sent right back. They do not keep or store it, and have agreed not to train on it. HIPAA mode lets you turn AI processing off entirely.
Can someone in a lawsuit get recordings of our calls?
Not from us without your consent. Federal law does not allow a phone company to give the contents of calls, voicemails, recordings or texts to a private party in a lawsuit. Only the government can get contents, and usually only with a warrant.
Questions about privacy?
Email legal@cannonvoip.com or call us. We're happy to walk your compliance team through it.