Is CallSprout HIPAA compliant?

CallSprout can be set up for HIPAA. We turn off features that send patient details outside the phone system, and send call recordings to storage you control. HIPAA compliance across your practice stays yours, so your own policies, training and other systems still matter. This is general information, not legal advice.

Can you help with PCI compliance?

Yes. We help you make your phone system PCI compliant, including how card numbers are handled on calls and in recordings. PCI compliance also covers the rest of your payment process, and that part stays yours.

Where are call recordings stored?

When you need recordings under your own encryption and retention rules, we send them to storage you choose, like Amazon S3, Microsoft Azure or your own servers. Once the transfer is done, we delete our copy.

Can we see details about your data centers?

Yes. Submit a request for information and we'll send documentation on our hosting environment for your security review.

Which features can be turned off?

Voicemail-to-email, voicemail transcription, fax-to-email, texting, AI call transcription and Sage can all be turned off, along with other features that send details outside the phone system. We go through the list with you during setup.

Compliance

A phone system built for your compliance needs.

HIPAA and PCI setup, encrypted calls, password-protected phones and voicemail, and the FCC rules handled on our side.

Request documents Book a demo

HIPAA

Set up for practices that handle patient information.

Healthcare customers get the same CallSprout phone system, configured for HIPAA before go-live. We walk your team through the settings that keep patient details inside the phone system.

See CallSprout for healthcare

Voicemail-to-email, transcription, fax-to-email, texting and other features that send details outside the phone system can be turned off.
Call recordings go to storage you choose, like Amazon S3, Microsoft Azure or your own servers, and we delete our copy once the transfer is done.
Calls are encrypted in transit, and desk phones and voicemail are password protected.
HIPAA compliance across your practice, including your other systems and policies, stays yours.

PCI

PCI compliance for the calls where you take payments.

We help you make your phone system PCI compliant, from how card numbers are handled on a call to what ends up in the recording. Keypad card entry is in early access, and we test it with your team before you take a live payment.

See how card payments work

Connected-system features work through your existing CRM or business system and depend on that system offering a compatible API. Availability varies by provider.

Callers can type their card number on their own phone keypad, so it's never read out loud.
Card numbers stay out of the conversation and the call recording.
We set up and test the payment flow with your team before you go live.
PCI compliance also covers how you take, store and process cards outside the phone system, and that part stays yours.

FCC and carrier rules

We handle the rules phone providers have to follow.

Phone companies answer to the FCC and the carriers, not just their customers. Here's what CallSprout does on our side so your calls and texts go through the right way.

Read the A2P 10DLC registration guide

Outbound calls are signed with STIR/SHAKEN, so carriers can verify they came from your number.
CallSprout is listed in the FCC Robocall Mitigation Database.
We file the yearly FCC CPNI certification covering how we protect your call records.
Our team handles A2P 10DLC registration for your business texting.
E911 with a dispatchable location is included.

For your security review

Documents and details when you need them.

Send us your questionnaire or ask for what your auditors need.

Recordings in your storage

Send call recordings to storage you control, under your own retention rules.

Agreements

A BAA and a DPA are available upon request.

Hosting and data centers

Submit a request for information and we'll send details on our hosting environment.

Encrypted calls

Calls are encrypted in transit.

Passwords on devices

Desk phones and voicemail boxes are password protected.

24/7 monitoring

Our servers and network are monitored around the clock.

More on the rules that apply to business calls.

Call recording laws by state →

Which states need one party's consent to record and which need everyone's.

Is it legal to record business calls? →

What to tell callers before you record.

VoIP and federal regulations →

How CPNI, HIPAA and Do Not Call rules apply to your phone system.

Questions

Compliance questions.

Is CallSprout HIPAA compliant?: CallSprout can be set up for HIPAA. We turn off features that send patient details outside the phone system, and send call recordings to storage you control. HIPAA compliance across your practice stays yours, so your own policies, training and other systems still matter. This is general information, not legal advice.
Can you help with PCI compliance?: Yes. We help you make your phone system PCI compliant, including how card numbers are handled on calls and in recordings. PCI compliance also covers the rest of your payment process, and that part stays yours.
Where are call recordings stored?: When you need recordings under your own encryption and retention rules, we send them to storage you choose, like Amazon S3, Microsoft Azure or your own servers. Once the transfer is done, we delete our copy.
Can we see details about your data centers?: Yes. Submit a request for information and we'll send documentation on our hosting environment for your security review.
Which features can be turned off?: Voicemail-to-email, voicemail transcription, fax-to-email, texting, AI call transcription and Sage can all be turned off, along with other features that send details outside the phone system. We go through the list with you during setup.

Tell us what your compliance team needs.

We'll show you how CallSprout is set up for it and send the documents you need.