Last updated: 10 June 2026. This page summarises the obligations OZOO.ai accepts as a data processor. The signed DPA — required before production data is processed — is available on request from security@ozoo.ai.
We respond to DPA, sub-processor and security-questionnaire requests within one business day. Send us your compliance review →
Customer is the data controller; OZOO.ai (Habilelabs) is the data processor for personal data submitted via the OZOO.ai platform.
Applies to all personal data processed by OZOO.ai on the customer's behalf, including call recordings, transcripts, derived analytics and customer-supplied identifiers.
Encryption in transit (TLS 1.2+) and at rest (AES-256), PII redaction at every persistence layer, role-based access, multi-factor authentication for privileged users, audit logs.
Current sub-processor list available on request from security@ozoo.ai; 30-day notice for material additions or changes; customer has the right to object.
India (default for Indian customers); United States and European Union regions configurable for global deployments. Documented per tenant.
Per-tenant retention windows configurable per data type (recordings, transcripts, aggregates). Right-to-erasure honoured programmatically across S3, DynamoDB and Athena layers within the SLA defined in the executed DPA.
Material personal-data breaches notified to the controller without undue delay and within the timelines defined under DPDP Act 2023 and any applicable regional law.
Customer-initiated audits supported subject to reasonable notice; annual third-party security attestations (SOC 2, ISO 27001 — in progress) will be shared once available.
Cross-border transfers governed by applicable transfer mechanisms (e.g., Standard Contractual Clauses) where required. Documented in the executed DPA.
Customer may request export of personal data in a standard format prior to deletion. Default deletion timeline: 30 days post-termination, configurable in the executed DPA.
Bring your security questionnaire, residency requirements or sub-processor concerns. We will get back within a business day.