Information Security

FAQs

Detailed description of processes, controls, and safeguards

What protocols, mechanisms, and controls does eAlicia employ to ensure that the transfer of recordings is carried out securely, efficiently, and in accordance with data protection requirements?

The platform receives and transmits recordings via SFTP and secure APIs, ensuring end-to-end encrypted transfer. In addition, all communications use TLS 1.3/SSL, ensuring confidentiality and integrity when sending audio or other files. The methods used are SFTP and APIs encrypted under HTTPS/TLS 1.3.

Does the organisation have a role-based access control system that restricts access to sensitive information during data transfer processes in a granular and verifiable manner?

The platform implements role-based access control (RBAC) based on the principle of least privilege, which applies to all processes, including data transfers. Furthermore, all access requires strong authentication, and connections are protected by MFA and secure credentials. This ensures that only authorized users can access sensitive information during transmission.

What protective measures and defence mechanisms have been implemented to prevent the interception of information or the execution of man-in-the-middle (MITM) attacks during the data transfer process?

The platform secures all transmissions using TLS 1.3/SSL and mutual certificate validation, preventing interception or tampering in transit. Additionally, transfers via SFTP and encrypted HTTPS APIs ensure integrity and authenticity. The architecture incorporates firewalls, IDS/IPS, and network segmentation, mitigating MITM attacks and unauthorized access.

Are the architecture and processes defined for information transfer designed to handle high volumes of files without compromising established security levels?

Yes, the transfer procedures are designed to handle large volumes of files without compromising security. eAlicia’s architecture uses asynchronous transfers encrypted via SFTP and APIs, designed to process large volumes of audio, text, and images without compromising security. All data transmission is protected by TLS 1.3/SSL, along with network segmentation and perimeter controls. Additionally, the data acquisition and processing mechanisms are modularized and orchestrated, allowing the system to handle high workloads without compromising data protection.

Established procedures for patch management, anti-malware solutions, use of encryption for data in transit, and backups

What methodology or formal process does the organisation use to coordinate, apply and verify the installation of patches and updates on servers and other operating and application systems?

Patch management procedures are in place that prioritize security patches on systems that process Confidential Information (ICF) or Personal Data (DTPS). In addition, records of all audit, monitoring, and security activities are retained for 120 days, allowing for verification that updates have been applied correctly. These processes are integrated into a secure environment with strict access controls, ensuring that patches are installed in a controlled manner.

What is the defined frequency for applying patches, and what verification mechanisms does the organisation use to confirm that each update has been correctly and effectively installed on the target systems?

Patches are prioritized when they are security-related; otherwise, they are applied every 3 months. Audit, monitoring, and security logs are retained for 120 days, which allows us to verify that the patches were applied correctly.

Does the organisation have a testing environment or pre-validation mechanisms in place to evaluate the behaviour of patches before they are deployed in production systems?

The platform maintains separate development, test, and production environments, which means that changes and updates—including patches—are first validated in non-production environments. In addition, the CI/CD model requires unit, functional, and integration tests, as well as security reviews, before any deployment to production. Therefore, there are indeed controls in place to ensure that patches are tested and validated beforehand.

Which antivirus and antimalware protection platforms, engines, or suites are deployed on the various systems to ensure threat detection, mitigation, and response?

TrendMicro.

What management and updating mechanisms does the organisation use to ensure that signature databases and malware definitions are kept permanently up to date on all protected systems?

The application itself automatically updates virus signatures on a scheduled basis, with centralized management.

Are security scans performed on a scheduled basis or continuously across the entire set of systems in order to proactively detect threats or anomalous activity?

The platform features continuous 24/7 monitoring through the SOC and systems such as IDS/IPS, PRTG, and centralized logs, which involves ongoing security and infrastructure analysis. In addition, internal audits, penetration testing, and periodic risk assessments are conducted to detect vulnerabilities. Although no specific frequency is specified for each system, the Security Policy confirms continuous and recurring controls across the entire infrastructure.

What cryptographic standards or algorithms are used to guarantee the confidentiality of data stored on servers and ensure that they meet the security requirements established by the organisation?

Backup media are encrypted, and data in transit uses TLS 1.3 with a 2048-bit RSA key exchange. In addition, credentials are encrypted using AES-256. Data is stored encrypted at rest.

What cryptographic mechanisms or encryption standards are specifically applied to backups to ensure that the information stored in them remains protected against unauthorised access or integrity compromises?

All backups are encrypted. TLS 1.3 + RSA-2048 is used for data in transit, and AES-256 is used for credentials. Therefore, the backups are encrypted.

What procedures, tools, and controls does the organisation apply to manage the lifecycle of cryptographic keys and ensure their protection against unauthorised access or misuse?

Credentials are encrypted using AES-256.

What is the defined frequency for rotating cryptographic keys, and what control mechanisms are applied to ensure that this process does not affect the integrity, availability, or accessibility of data already stored or encrypted with previous keys?

Every three months.

Which profiles or roles are authorised to access cryptographic keys, and what control mechanisms—such as segregation of duties, access logs, or least privilege policies—are applied to restrict and monitor such access?

Access to encryption keys is restricted exclusively to authorized IT personnel, in accordance with strict security controls. Only these users may manage them, applying RBAC, the principle of least privilege, and segregation of duties, ensuring that no other user or department has access to these keys. In addition, all actions related to their use or administration are logged and audited to ensure traceability and control.

Are encryption mechanisms used to protect information during transmission, both in communication flows between servers and in data sending or retrieval operations associated with backups?

All data in transit is encrypted using TLS 1.3 with 2048-bit RSA, including internal transfers between servers and data flows to and from backup systems. In addition, communications between zones within the architecture use SSL certificates and mutual authentication, ensuring integrity and confidentiality. Therefore, mandatory encryption is in place for all data in transit, including data related to backups.

Do the encryption methods implemented comply with applicable technical standards and regulatory requirements—such as AES in its approved variants, FIPS 140-2 validations, or data protection obligations derived from the GDPR—and is there formal evidence to prove it?

TLS 1.3 with RSA-2048 and AES-256 encryption is used for credentials, in accordance with industry standards and frameworks such as GDPR, ISO 27001, ENS, SOC 2, and NIST SP 800-53. The encryption complies with the aforementioned security and data protection frameworks and regulations (GDPR, LOPDGDD, AI Act, etc.).

What protocols has the organisation defined to manage the loss, exposure or compromise of a cryptographic key, including the processes for revocation, replacement, notification and mitigation of the impact on the affected systems and data?

In the event of the loss or compromise of an encryption key, an internal incident response procedure—managed by the IT team—is implemented. This process includes the immediate revocation of the affected key, its secure rotation or regeneration, and verification that there is no impact on data integrity or availability. All actions are logged and audited, ensuring traceability and compliance with security policies.

Independent databases with logical separation to isolate environments and ensure greater security in development and operation processes.

Is it necessary to have a more comprehensive description of the mechanisms that ensure segregation between environments — including logical controls, access restrictions, data isolation, and additional protection measures that effectively guarantee such separation?

Each customer’s data is stored in separate databases, and there are distinct development, pre-production, and production environments, each with its own control mechanisms: firewall policies, schema separation, specific VLANs, and RBAC controls per instance.

What access control systems, authorisation policies and validation mechanisms are in place to ensure that only duly authorised personnel can interact with each environment or with the various databases that operate independently?

Access is protected through role-based access control (RBAC), applying the principle of least privilege to limit which users can access each environment or database. In addition, robust authentication is required, including strong passwords and lockouts for failed login attempts. All access is logged and audited, and restricted solely to roles defined for each system or resource.

Are there oversight mechanisms and audit systems in place that can continuously record, correlate, and review access, modifications, and activities carried out within the various segregated environments?

Yes. We use Subversion and maintain system logs.
The servers retain audit, monitoring, and security logs for 120 days, including data access, insertions, and modifications. In addition, the platform features continuous monitoring (24/7 SOC/NOC) and centralized logging to detect unauthorized changes or access. All logs are role-based and form part of internal audit and compliance processes.

What security controls, data protection mechanisms, and safeguards does the organisation apply within each segregated environment to ensure the confidentiality, integrity, and proper management of the sensitive information stored there?

Each separate environment protects sensitive data through encryption at rest and in transit (TLS 1.3, RSA-2048), along with role-based access control (RBAC) that strictly restricts who can view or modify information. In addition, all actions are recorded in auditable logs, and personal data is anonymized or pseudonymized before any processing takes place.

What incident management procedures does the organisation have in place to detect, contain, analyse and resolve security breaches that may occur within each segregated environment, including response, escalation and operational restoration protocols?

The platform features an internal SOC that monitors 24/7, generating automatic alerts in the event of any anomaly or incident in any separate environment. In addition, there are documented incident management and response procedures, aligned with ISO 22301 and ISO 27001, that include analysis, containment, and communication with the customer. All events are recorded in auditable logs, enabling investigation and complete traceability.

Critical Considerations for Protecting AI-Based Systems. Additional Information on Security Controls and Practices

What techniques, algorithms, and processes does the artificial intelligence system apply to anonymise or pseudonymise identifiable data, ensuring that personal information cannot be re-associated with the individuals to whom it belongs?

Anonymization is performed using automated processes that detect patterns and entities identifying personal data and replace them with irreversible identifiers. This substitution is tailored to each case, upon request, based on the information to be protected (for example: account numbers, ID numbers, numerical codes, names, dates, or sensitive references such as medical information). When requested by the client, this data may also be pseudonymized prior to processing.

How effective is the artificial intelligence system in identifying sensitive information and subsequently applying anonymisation or pseudonymisation techniques, and how is this performance measured or validated?

Through substitution processes, the rate is 100%.

What security controls, defence mechanisms and hardening measures have been put in place to prevent unauthorised access to the artificial intelligence model and to protect it from attempts at manipulation, parameter alteration or malicious interference in its operation?

AI models are isolated on the private network, with no connection to external services, and protected by network segmentation, firewalls, WAFs, and IDS/IPS. Access is controlled through RBAC, MFA, and least-privilege policies, with full traceability of all actions. All communications are encrypted using TLS 1.3/SSL, and changes go through a secure CI/CD pipeline that includes validation and vulnerability scanning. In addition, a 24/7 SOC monitors for any intrusion or tampering attempts. Only authorized IT department personnel have access to the servers hosting the AI models.

What protection mechanisms, cryptographic controls, and assurance measures are applied to ensure that artificial intelligence models maintain their integrity and confidentiality both during the training phases and in their subsequent deployment in operational environments?

Integrity and confidentiality are ensured through isolated environments, segmentation between training, validation, and production, TLS 1.3/SSL encryption, and RBAC+MFA access control. Deployments go through a secure CI/CD pipeline that includes audits and vulnerability scans, and a 24/7 SOC monitors for any anomalies or tampering attempts.

Are security assessments carried out periodically on artificial intelligence models—including robustness testing, vulnerability detection, and bias analysis—in order to identify potential risks that could compromise the exposure of sensitive data?

Yes, at least once a month. eAlicia conducts periodic risk assessments, ethical audits, and bias reviews on all AI models, including generative, analytical, and transcription models. These analyses aim to detect vulnerabilities, deviations, discriminatory biases, or anomalous behavior. In addition, monthly calibrations and validations with human oversight are performed to ensure safety and fairness. All of this is part of a formal program of continuous monitoring and compliance with the AI Act and GDPR, preventing accidental exposure of sensitive data.

What verification mechanisms, validation tests and quality controls are applied to confirm that the anonymisation and/or pseudonymisation processes are operating correctly before the system processes real information, thus ensuring the effectiveness of the techniques and the absence of re-identification risks?

Unit tests are performed to validate the anonymization of the requested data.

What oversight, validation, and cleansing mechanisms does the organisation apply to ensure that, once training is complete, no sensitive data or traces remain in the model that could lead to unintentional leaks or residual storage of identifiable information?

At the customer’s request (though this is not always necessary), data is anonymized before being sent to the AI models, with all personal data replaced by irreversible identifiers. In addition, ethical audits, periodic bias reviews, and human oversight are conducted to ensure that no sensitive data is embedded in or left as residual data in the models.

Are differential privacy techniques or other advanced privacy preservation approaches used to minimise the possibility that the trained model could reveal sensitive information or allow re-identification of the data used during its training?

It is not necessary to apply differential privacy because models are not trained using customer data. Queries to the models (LLMs) are used solely to analyze the context received at that moment, with no retention or learning from that information. Furthermore, the data can be anonymized beforehand, and the analysis focuses exclusively on agent behavior, conversations, and the quality of interactions, thereby avoiding any risk of exposure.

What compliance processes, technical verifications, and regulatory controls does the organisation apply to ensure that artificial intelligence models operate in accordance with the privacy and data protection obligations required by regulatory frameworks such as the GDPR, LGPD, or other applicable regulations?

Compliance is ensured through a fully isolated architecture, where all data is processed exclusively within our private network and is never sent to external services. Queries to the models are made solely from eAlicia’s internal processes, with no possibility of external access, ensuring absolute control over the flow of information. Furthermore, upon the customer’s request, data can be anonymized or pseudonymized prior to processing, thereby strengthening privacy protection and ensuring compliance with regulations such as the GDPR and LGPD.

In relation to the process that converts the transcript into information that can be visualised on the dashboard, what artificial intelligence solution or analytical engine is used to process, interpret and structure the data generated?

Open-source and proprietary models running locally.
Our AI is based on auditable open-source models (Whisper, Llama, Mistral) and proprietary models trained in-house, all running exclusively on our servers within the data center. The underlying technology uses frameworks such as PyTorch, TensorFlow, and HuggingFace, installed locally and without connection to external services. We do not use third-party APIs or public clouds, so no data is sent outside our infrastructure. All processing takes place in private, isolated environments under our full control. This guarantees complete confidentiality and data sovereignty.

What contractual mechanisms, technical controls, and operational restrictions ensure that the use of the tool is limited exclusively to the Client's project and that the processed information cannot be reused, integrated, or transferred to other developments, models, or initiatives of the organisation?

The tool is closed by design, because all AI models run exclusively on our private, isolated infrastructure, which is disconnected from external services. Each customer’s data is processed in logically separate instances, with independent databases that prevent any mixing between projects. There is no continuous training or cross-learning: the models do not reuse information or incorporate customer data into their internal operations. All access is regulated by RBAC, auditing, and authorization workflows, ensuring that only authorized personnel can interact with the environments. Furthermore, contractual commitments reinforce that the client’s information is used exclusively for their own service and is never shared or applied outside their scope.

What defence mechanisms, hardening techniques, and security strategies are applied to protect artificial intelligence models against targeted attacks—including attempts to extract sensitive information, reverse engineer, or manipulate their internal parameters—and ensure their resilience against advanced threats?

The platform protects models through complete isolation within the private network, with no exposure to external services, along with strict segmentation between training, validation, and production. In addition, it employs firewalls, WAF, IDS/IPS, TLS 1.3 encryption, RBAC, MFA, and 24/7 SOC monitoring, preventing unauthorized access or data extraction attempts. Finally, ethical audits, periodic bias reviews, and full traceability throughout the model’s lifecycle ensure that sensitive information cannot be inferred or extracted.

Formal guidelines governing the secure storage and disposal of sensitive information in a controlled manner and in accordance with regulatory requirements.

Is it essential to have a comprehensive description of the retention policies applied, both to the data derived from the recordings and to the recordings themselves that are shared, in order to ensure their preservation, processing and disposal in accordance with established legal and operational requirements?

Yes. A distinction is made between original recordings and processed data, each with different retention policies (for example, audio recordings are retained for a maximum of 3 months, and data is retained only for auditing purposes). Therefore, it is necessary to have a detailed understanding of both policies to ensure secure deletion and regulatory compliance.Data is securely deleted upon termination of the contract or at the customer’s request, ensuring compliance with the GDPR and LGPD.

What retention period has been defined for the data—expressed in days or months—and under what specific conditions could this retention period be extended based on legal, operational, or compliance requirements?

Audio recordings are retained for a maximum of 3 months and may only be retained longer if the client expressly requests it. The processed data (transcripts, analyses, etc.) are retained only for as long as necessary for audit purposes. Any extension of this period requires a request and explicit authorization from the client.

Call Transcription: Are calls recorded for transcription purposes? What technology, engine, or transcription system is used to process and convert the audio into text?

Yes, calls are recorded.
The platform uses AI transcription models installed and run on-premises, within a private environment, without sending any information to external services.
The models used include open-source models such as Whisper, as well as variants and specific models developed in-house, all of which run exclusively on eAlicia’s private infrastructure. These models process the audio within the data center, without any connection to third parties and with full control over the data flow.

What secure deletion techniques are applied—such as certified logical erasure, multiple overwriting, cryptographic destruction, or other equivalent procedures—to ensure that the information is irreversibly deleted and cannot be recovered by subsequent technical means?

The platform ensures secure data disposal through verifiable destruction once the intended purpose has been fulfilled, including certified reports upon customer request. In addition, backups are immutable, encrypted, and subject to limited retention, ensuring that no residual data remains after the end of its lifecycle. The process is carried out within private environments that are controlled in accordance with the GDPR, LOPDGDD, and ISO 27001.

Do disposal policies and procedures also cover the purging of information stored in backup systems, ensuring that deleted data does not remain in backups or can be restored at a later date?

Backups are retained only for the specified period (90 days) and are then deleted in accordance with internal business continuity and security policies. The copies are immutable, encrypted, and periodically verified, ensuring that no information remains beyond the authorized retention period. Therefore, yes: the deletion process includes the removal of data from backups once their retention period has expired. Data is securely deleted upon contract termination or at the customer’s request, ensuring compliance with the GDPR and LGPD.

QUERIES RELATED TO INFRASTRUCTURE AND TECHNOLOGICAL ARCHITECTURE

What set of security architectures, operational controls, and physical and logical protection mechanisms are implemented in the Data Processing Centre (DPC) to ensure a robust, isolated, and resilient environment against internal and external threats?

The servers are housed in a data center, to which only the CTO and a select few technicians have access, using an access card and a physical key.
The data center maintains a secure environment through advanced certifications and standards (ISO 27001, high-level ENS, GDPR, ISO 22301, ISO 27017), as well as reinforced physical infrastructure, biometric access control, CCTV, and 24/7 surveillance. It also utilizes fire detection systems, electronic doors, biometric scanners, and burglar alarms to ensure perimeter protection. All access is documented and controlled, ensuring traceability and ongoing compliance.

In which geographical locations or storage regions are the backups hosted, and what criteria were used to define this territorial distribution?

Backups are stored on the data center’s own NAS, and a second copy is also made at an alternate geographic location. As for critical infrastructure, the platform maintains replicated backups between the VODAFONE and COLT data centers, located in Barcelona and Madrid, ensuring resilience and continuity.

What type of support technology is used for backup storage: tape-based systems, disk storage platforms, array infrastructures, or other equivalent media?

We do not use tapes. Backups are stored on NAS devices within the data center itself, which means disk-based storage or storage arrays, not tapes. In addition, there is a second copy at an alternate geographic location, also managed using similar storage infrastructure.

More information

Download PDF for further information on Safety.