The security review,
before you ask.
Discentra detects behavioural triggers and places an AI coaching call to your traders within 5 seconds. This page covers what we collect, what we never request, who processes it, and what happens when something goes wrong. Coaching, not financial advice.
What we collect, and what we never request
Scope is the first security control. The behavioural engine runs on seven trade fields and nothing else, and the phone number that places the call is held apart and encrypted. Why the price is one of the fields we refuse.
Collected
- Pseudonymised trader ID
- Trade ID
- Whether the trade opened or closed
- Trade timestamp
- Instrument symbol
- Trade size
- P&L when the trade closes
- Phone number, held apart and field-level encrypted
- Call recordings and transcripts
- SMS messages and replies
- Consent choices and their date
Never requested
- Entry and exit prices
- Stop-loss and take-profit levels
- Trade direction
- Account balances
- Net worth
- Government IDs
- Card numbers
- Home addresses
Anything a trader says on a call or writes in a reply is held only as part of that recording or message.
Encryption and data handling
The defaults your DPA will hold us to.
Recordings
Every call recording we store is encrypted with AES-256-GCM. The voice platform's copies sit under its own encryption and access controls.
Phone numbers
Field-level encrypted, and deleted within 30 days of a trader leaving the cohort.
In transit
TLS on every connection between your platform and Discentra.
Retention
Recordings, transcripts and SMS content kept no longer than 90 days by default, and up to 7 years only where a client notifies a regulatory record-keeping requirement in writing. The 90-day default includes the voice platform's copies, whose retention we set on every agent when a client is onboarded. The telephony provider's own logs follow its retention policy.
Erasure
GDPR erasure requests completed within 30 days.
Residency
EU-region database provisioned per client engagement (unless an Enterprise contract agrees another region). Trader data never sits in general business tooling.
Compliance, signed and maintained
A signed governance suite, reviewed on a schedule and available under NDA.
Data protection impact assessment
Processing risks assessed and mitigated, with a standing review date.
Record of processing activities
Every processing activity and sub-processor on the record.
EU AI Act Article 50 assessment
Disclosure obligations mapped. Every call announces that it is AI.
Transfer impact assessment
The UK-to-India transfer to our build partner assessed and documented; other transfer routes recorded in the processing register.
Information security policy
MFA on every service that supports it, device security, key handling, access registers.
Breach-response runbook
A documented incident protocol with a 72-hour ICO notification path.
Data retention schedule
Retention periods and deletion methods, defined per data class.
A DPA is signed before any data transmission.
Trader consent is collected before any call, SMS, or recording.
A crisis escalation contact is a hard prerequisite. No deployment without one.
Every call includes an AI disclosure, per EU AI Act Article 50.
Infrastructure and sub-processors
Who touches trader data, and whose certificates they hold.
Retell AI
Voice platform
SOC 2 Type II certified, and states HIPAA and GDPR compliance. Runs on AWS infrastructure. Zero-data-retention agreements with OpenAI, ElevenLabs, and Anthropic. Keeps its own copies of recordings, transcripts and logs for the period we set on each of its agents at provisioning (indefinite by default).
Supabase
Database
ISO 27001 certified. The certificate is held by Supabase, not by Discentra. An EU region (Frankfurt or Ireland) chosen when a client's database is set up. Encrypted at rest and backed up daily.
Model layer
LLM, via Retell
GPT-4.1 primary with Claude as fallback, orchestrated through Retell, which has zero-data-retention agreements with OpenAI and Anthropic.
Twilio
Telephony
SOC 2 Type II, ISO 27001 and PCI DSS, each for the products it covers, and HIPAA for eligible products. Phone numbers stay inside production-data controls.
These certifications belong to the vendors named above, not to Discentra. Our own assurance is the signed governance suite and the DPA that binds it. The full sub-processor list ships with the DPA.
Built for breach
Zero-trust design for an AI agent that handles trader data on behalf of regulated firms.
Never trust, always verify
Every access request is authenticated and authorised, regardless of origin.
Assume breach
The platform is designed to contain damage when a compromise occurs, not only to prevent one.
Least agency
Each agent receives the access its function requires, and nothing more.
The design test for every control: does it make an attack impossible, or only tedious? We prefer removing a capability over slowing an attacker down.
Least agency in practice
The voice agent can place a coaching call and write call records for its own tenant. It holds no send or delete rights on unrelated systems and no cross-tenant access.
Per-tenant isolation
Multi-tenant isolation seals each client off from every other client. Identity-based first, with network segmentation as the backstop.
Append-only audit trail
Every agent action is logged with agent identity, timestamp, and the trigger that fired it. Each coaching call traces back to its cause, which supports a trader's right to ask for a person to review it, and any record-keeping period a client notifies, up to 7 years.
Short-lived credentials
Inside the platform, service access is designed to use short-lived, scoped tokens that refresh automatically. Client API keys are stored as hashes, rate-limited and rotatable, and every admin portal account requires MFA.
Untrusted input, by default
Trader SMS replies are treated as untrusted input and validated before they can influence the agent. Output filtering and the coaching-not-advice boundary are enforced in the architecture, with crisis detection and jailbreak blocking at the voice layer.
Discentra builds the production platform per client engagement. The governance suite above is signed and operational today. Platform controls are designed in and delivered with the build at your tier, and in diligence we mark which is which.
Frequently asked questions
Discentra's copy of trader data is stored in a Supabase database created in an EU region (Frankfurt or Ireland) when your engagement is set up, unless an Enterprise contract agrees another region. The data is encrypted at rest and backed up daily by the provider. Voice processing runs through Retell AI on AWS infrastructure. Retell AI has zero-data-retention agreements with OpenAI, ElevenLabs and Anthropic, but keeps its own copies of recordings, transcripts and logs indefinitely unless a retention period is set, so we set one on each of its agents when a client is onboarded. Telephony runs through Twilio. Trader data is never stored in general business tooling.
No, and we will not blur that line. ISO 27001 belongs to Supabase, the database sub-processor. SOC 2 Type II belongs to Retell AI, the voice platform. Twilio, the telephony provider, holds its own SOC 2 reports. Discentra's own assurance is a signed and maintained governance suite: data protection impact assessment, record of processing activities, EU AI Act Article 50 assessment, transfer impact assessment, information security policy, breach-response runbook, and data retention schedule, plus ICO registration ZC108503. The full pack is available under NDA.
Seven trade fields: a pseudonymised trader ID, the trade ID, whether the trade opened or closed, its timestamp, the instrument symbol, the trade size, and the P&L when it closes. Separately, a phone number, field-level encrypted and used only to reach the trader by call or text. Discentra also holds the call recordings and transcripts, the SMS messages and replies, and the trader's consent choices with their dates. Discentra never requests entry or exit prices, stop-loss or take-profit levels, trade direction, account balances, net worth, government IDs, card numbers, or home addresses.
Your platform sends trade events over a REST API or WebSocket. Every request is authenticated at the gateway with JWT or API-key auth, encrypted in transit with TLS, and scoped to your tenant. Inside the platform, agents are built to run on short-lived scoped credentials, with every action written to an append-only audit log.
A documented breach-response runbook is operational today, with a 72-hour ICO notification path and client notification obligations written into the DPA. The architecture is designed on the assumption of a breach: per-tenant isolation and least-agency scoping, delivered with the build, limit how far a compromise can reach.
Discentra is ICO-registered (ZC108503) and processes trader data under a signed data protection impact assessment and record of processing activities. A DPA is signed before any data transmission. Trader consent is collected before any call, SMS, or recording. Erasure requests complete within 30 days. Recordings, transcripts and SMS content are kept no longer than 90 days by default, and up to 7 years only where a client notifies a regulatory record-keeping requirement in writing. The 90-day default includes the voice platform's copies, whose retention we set on every agent when a client is onboarded. The telephony provider's own logs follow its retention policy.
Put this page in front of your security team.
The signed documentation pack, DPIA to breach runbook, is available under NDA. Bring the questionnaire.