# The security review, before you ask. > How Discentra is built to protect trader data: what it collects, how it is encrypted, who processes it, and the signed documents behind it. Coaching, not financial advice. Discentra is a B2B AI voice coaching platform for prop trading firms, brokers, and crypto exchanges. It detects behavioural triggers in real time and places an AI coaching call to the trader within 5 seconds. This page is written for the security, risk, and engineering teams who assess Discentra during procurement. ## What we collect, and what we never request Scope is the first security control. The behavioural engine runs on seven trade fields and nothing else, and the phone number that places the call is held apart and encrypted. Why the price is one of the fields we refuse: https://discentra.ai/blog/the-coach-that-never-sees-the-price **Collected:** - Pseudonymised trader ID - Trade ID - Whether the trade opened or closed - Trade timestamp - Instrument symbol - Trade size - P&L when the trade closes - Phone number, held apart and field-level encrypted - Call recordings and transcripts - SMS messages and replies - Consent choices and their date **Never requested:** - Entry and exit prices - Stop-loss and take-profit levels - Trade direction - Account balances - Net worth - Government IDs - Card numbers - Home addresses Anything a trader says on a call or writes in a reply is held only as part of that recording or message. ## Encryption and data handling The defaults your DPA will hold us to. - **Recordings.** Every call recording we store is encrypted with AES-256-GCM. The voice platform's copies sit under its own encryption and access controls. - **Phone numbers.** Field-level encrypted, and deleted within 30 days of a trader leaving the cohort. - **In transit.** TLS on every connection between your platform and Discentra. - **Retention.** Recordings, transcripts and SMS content kept no longer than 90 days by default, and up to 7 years only where a client notifies a regulatory record-keeping requirement in writing. The 90-day default includes the voice platform's copies, whose retention we set on every agent when a client is onboarded. The telephony provider's own logs follow its retention policy. - **Erasure.** GDPR erasure requests completed within 30 days. - **Residency.** EU-region database provisioned per client engagement (unless an Enterprise contract agrees another region). Trader data never sits in general business tooling. ## Compliance, signed and maintained A signed governance suite, reviewed on a schedule and available under NDA. - **Data protection impact assessment.** Processing risks assessed and mitigated, with a standing review date. - **Record of processing activities.** Every processing activity and sub-processor on the record. - **EU AI Act Article 50 assessment.** Disclosure obligations mapped. Every call announces that it is AI. - **Transfer impact assessment.** The UK-to-India transfer to our build partner assessed and documented; other transfer routes recorded in the processing register. - **Information security policy.** MFA on every service that supports it, device security, key handling, access registers. - **Breach-response runbook.** A documented incident protocol with a 72-hour ICO notification path. - **Data retention schedule.** Retention periods and deletion methods, defined per data class. Registered: ICO registration ZC108503. Company No. 16098798 (United Kingdom). Operating rules: - A DPA is signed before any data transmission. - Trader consent is collected before any call, SMS, or recording. - A crisis escalation contact is a hard prerequisite. No deployment without one. - Every call includes an AI disclosure, per EU AI Act Article 50. ## Infrastructure and sub-processors Who touches trader data, and whose certificates they hold. | Vendor | Role | Security posture | |---|---|---| | Retell AI | Voice platform | SOC 2 Type II certified, and states HIPAA and GDPR compliance. Runs on AWS infrastructure. Zero-data-retention agreements with OpenAI, ElevenLabs, and Anthropic. Keeps its own copies of recordings, transcripts and logs for the period we set on each of its agents at provisioning (indefinite by default). | | Supabase | Database | ISO 27001 certified (the certificate is held by Supabase, not by Discentra). An EU region (Frankfurt or Ireland) chosen when a client's database is set up. Encrypted at rest and backed up daily. | | Model layer | LLM, via Retell | GPT-4.1 primary with Claude as fallback, orchestrated through Retell, which has zero-data-retention agreements with OpenAI and Anthropic. | | Twilio | Telephony | SOC 2 Type II, ISO 27001 and PCI DSS, each for the products it covers, and HIPAA for eligible products. Phone numbers stay inside production-data controls. | These certifications belong to the vendors named above, not to Discentra. Our own assurance is the signed governance suite and the DPA that binds it. The full sub-processor list ships with the DPA. ## Built for breach Zero-trust design for an AI agent that handles trader data on behalf of regulated firms. Three principles: - **Never trust, always verify.** Every access request is authenticated and authorised, regardless of origin. - **Assume breach.** The platform is designed to contain damage when a compromise occurs, not only to prevent one. - **Least agency.** Each agent receives the access its function requires, and nothing more. The design test for every control: does it make an attack impossible, or only tedious? We prefer removing a capability over slowing an attacker down. - **Least agency in practice.** The voice agent can place a coaching call and write call records for its own tenant. It holds no send or delete rights on unrelated systems and no cross-tenant access. - **Per-tenant isolation.** Multi-tenant isolation seals each client off from every other client. Identity-based first, with network segmentation as the backstop. - **Append-only audit trail.** Every agent action is logged with agent identity, timestamp, and the trigger that fired it. Each coaching call traces back to its cause, which supports a trader's right to ask for a person to review it, and any record-keeping period a client notifies, up to 7 years. - **Short-lived credentials.** Inside the platform, service access is designed to use short-lived, scoped tokens that refresh automatically. Client API keys are stored as hashes, rate-limited and rotatable, and every admin portal account requires MFA. - **Untrusted input, by default.** Trader SMS replies are treated as untrusted input and validated before they can influence the agent. Output filtering and the coaching-not-advice boundary are enforced in the architecture, with crisis detection and jailbreak blocking at the voice layer. Discentra builds the production platform per client engagement. The governance suite above is signed and operational today. Platform controls are designed in and delivered with the build at your tier, and in diligence we mark which is which. ## Frequently asked questions **Where is trader data stored?** Discentra's copy of trader data is stored in a Supabase database created in an EU region (Frankfurt or Ireland) when your engagement is set up, unless an Enterprise contract agrees another region. The data is encrypted at rest and backed up daily by the provider. Voice processing runs through Retell AI on AWS infrastructure. Retell AI has zero-data-retention agreements with OpenAI, ElevenLabs and Anthropic, but keeps its own copies of recordings, transcripts and logs indefinitely unless a retention period is set, so we set one on each of its agents when a client is onboarded. Telephony runs through Twilio. Trader data is never stored in general business tooling. **Is Discentra ISO 27001 or SOC 2 certified?** No, and we will not blur that line. ISO 27001 belongs to Supabase, the database sub-processor. SOC 2 Type II belongs to Retell AI, the voice platform. Twilio, the telephony provider, holds its own SOC 2 reports. Discentra's own assurance is a signed and maintained governance suite: data protection impact assessment, record of processing activities, EU AI Act Article 50 assessment, transfer impact assessment, information security policy, breach-response runbook, and data retention schedule, plus ICO registration ZC108503. The full pack is available under NDA. **What data does Discentra collect?** Seven trade fields: a pseudonymised trader ID, the trade ID, whether the trade opened or closed, its timestamp, the instrument symbol, the trade size, and the P&L when it closes. Separately, a phone number, field-level encrypted and used only to reach the trader by call or text. Discentra also holds the call recordings and transcripts, the SMS messages and replies, and the trader's consent choices with their dates. Discentra never requests entry or exit prices, stop-loss or take-profit levels, trade direction, account balances, net worth, government IDs, card numbers, or home addresses. **How is the integration secured?** Your platform sends trade events over a REST API or WebSocket. Every request is authenticated at the gateway with JWT or API-key auth, encrypted in transit with TLS, and scoped to your tenant. Inside the platform, agents are built to run on short-lived scoped credentials, with every action written to an append-only audit log. **What happens if there is a breach?** A documented breach-response runbook is operational today, with a 72-hour ICO notification path and client notification obligations written into the DPA. The architecture is designed on the assumption of a breach: per-tenant isolation and least-agency scoping, delivered with the build, limit how far a compromise can reach. **How does Discentra handle GDPR?** Discentra is ICO-registered (ZC108503) and processes trader data under a signed data protection impact assessment and record of processing activities. A DPA is signed before any data transmission. Trader consent is collected before any call, SMS, or recording. Erasure requests complete within 30 days. Recordings, transcripts and SMS content are kept no longer than 90 days by default, and up to 7 years only where a client notifies a regulatory record-keeping requirement in writing. The 90-day default includes the voice platform's copies, whose retention we set on every agent when a client is onboarded. The telephony provider's own logs follow its retention policy. ## Related links - [How Discentra works](https://discentra.ai/how-it-works) - [Privacy policy](https://discentra.ai/privacy) - [Why traders quit](https://discentra.ai/why-traders-quit) - [Get in touch](https://discentra.ai/get-in-touch) --- This is a Markdown mirror of [https://discentra.ai/security](https://discentra.ai/security). Provided for LLM citation. © Discentra Ltd. Coaching, not financial advice.