Data handling
The production data-handling design
The proof of concept is not complete. This page records the constraints that a production deployment must satisfy before it handles a live firm call.
Last updated August 8, 2026
One Fly machine per firm is required
Each production firm deployment will run on a dedicated Fly application and machine. The runtime, firm configuration, credentials, and stored call records will be separated from every other client deployment.
No training on client data
The design uses the OpenAI API. OpenAI does not train its models on API data by default, and we will not opt in to data sharing for training.
Limited call records
The production service will store the administrative fields needed for a callback, a provisional booking, routing, and the call report. Raw audio will not be stored in our systems by default.
Firm-controlled delivery
Call records and booking results will go only to the recipients and systems the firm approves. The firm will also set its retention period and escalation contacts.
Planned call data path
Where a production call will go
The carrier has not been selected. The final provider names and DPA links will be published after the proof of concept and before live firm calls are processed. The firm's calendar and communication systems will remain under the firm's own accounts and vendor terms.
- 1
Telephone carrier
Carries the call and connects it to the voice session.
- 2
OpenAI Realtime
Processes live speech and returns the assistant's response.
- 3
Dedicated Fly machine
Runs the firm's call rules, tools, session state, and structured record.
- 4
Firm systems
Receive the provisional booking and approved administrative call record.
OpenAI retention and training
OpenAI states that data sent to the API is not used to train or improve its models unless the API customer explicitly opts in. We do not opt in for this service.
The Realtime API has no application-state retention for the session. OpenAI's default abuse-monitoring logs can retain API content for up to 30 days. Eligible API customers can apply for Modified Abuse Monitoring or Zero Data Retention. We document the control in use for each firm in its service configuration.
Read OpenAI's current data controlsAccess, retention, and deletion
Access to a firm's production deployment will be limited to Appalytical personnel who operate that deployment and to the firm recipients named in its configuration. Each firm will use separate credentials and storage.
The firm's agreement records the retention period and deletion window for structured call records. Deletion requests follow the process on the privacy page.