Safety, Security, and Compliance

How MERCENAI approaches responsible AI calling, sensitive data, outbound rules, BAA requests, and security.

Safety, security, and compliance

MERCENAI is built for businesses that depend on calls, customer trust, and clean follow-up. We design the platform to support responsible use of AI phone agents, while customers remain responsible for how they configure agents, what data they upload, and who they call.

Telemarketing and outbound calling

Outbound calling laws can require consent, do-not-call screening, calling-hour limits, caller identity disclosures, AI voice disclosures, opt-out handling, and consent records. You are responsible for making sure every campaign follows the laws that apply to your business and your callers.

  • Use approved lead sources only.
  • Keep consent records where required.
  • Respect federal, state, internal, and customer-specific do-not-call lists.
  • Do not use MERCENAI for spam, harassment, fraud, or deceptive calling.
  • Include AI and recording disclosures when required by law.

Call recording and caller consent

Some states and countries require consent before recording calls or processing call audio. You are responsible for deciding when recording is enabled, what disclosures are used, and whether consent is required before a call continues.

HIPAA and BAA support

For eligible healthcare workflows, MERCENAI supports a fail-closed approval process. Do not upload protected health information or use MERCENAI for HIPAA-regulated work unless a customer BAA is signed, required vendor BAAs and safeguards are confirmed, the risk review is complete, and the exact workspace is approved.

MERCENAI does not claim that every account, workflow, vendor path, or customer use case is automatically HIPAA compliant. Prompts alone do not create HIPAA compliance.

GDPR and DPA requests

If your business requires a Data Processing Agreement, contact us before uploading regulated personal data. The review covers processing roles, instructions, subprocessors, security, retention, data rights, breach support, and international transfer safeguards.

MERCENAI generally controls website, account, billing, and security data and generally acts as a processor for customer-controlled leads, calls, recordings, transcripts, messages, and knowledge content.

Security practices

  • Access controls for account data and dashboard access.
  • Use of established service providers for hosting, payments, communications, and infrastructure.
  • Commercially reasonable safeguards for data in transit and at rest where supported by service providers.
  • Monitoring and abuse-prevention controls designed to protect the platform.
  • Owner-scoped dashboard data, signed tenant context, encrypted provider credentials, private recording playback, and fail-closed healthcare gates.
  • Operational review of sensitive or high-volume use cases when needed.

Customer responsibility

MERCENAI provides tools. You control the caller lists, scripts, rules, offers, disclosures, escalation paths, and business data. You are responsible for reviewing agent behavior, testing before launch, monitoring live use, and complying with laws that apply to your business.

Need a BAA, DPA, or compliance review?

Message https://telegram.me/trymercenai with your company name, use case, industry, expected call volume, and whether you need a BAA or DPA.

Helpful public resources