How we handle your data.
CX Foundry starts with data. We need call recordings or transcripts to drive the process, but we understand that handling sensitive customer data is a big responsibility. That’s why we use a dedicated secure environment, process, and toolset to receive, transcribe, and redact your data — operated under Waterfield Tech’s ISO/IEC 27001-certified Information Security Management System.
Read on to understand what we need from you and how we keep you, your customers and your data safe. Feel free to share with your information security team.
Credentials to an Azure Blob Storage location we provision for you.
Azure AI Services, inside the secure environment.
Names, IDs, card numbers, addresses, emails replaced with labels.
A human checks for anything left. If found, redaction runs again.
Approved AI tools only: Microsoft, OpenAI, Google, Anthropic.
180 days after the engagement, from storage and backups.
What we ask for
1,000+ recordings or transcripts plus operating context. You keep all rights to your data.
A representative sample of your customer interactions — typically 1,000+ audio recordings or text transcripts — plus enough operating context to make sense of them. You retain all right, title, and interest in your data.
How you share it
Your own Azure Blob container. Stereo audio or timestamped transcripts preferred.
We securely share credentials to a Microsoft Azure Blob Storage location we provision for you. We’re flexible on format, but prefer high-quality stereo audio with separate channels for customer and service agent, or transcribed data with timestamps.
Where it lives
Two client-isolated containers, least-privilege access, every action logged.
We provision two client-isolated Azure Blob Storage containers: one for non-redacted data, one for redacted. We apply least-privilege, role-based access. Only a small number of named delivery staff have access, and their actions are logged and monitored, with alerting on anomalies.
Only data that has completed redaction and review is approved to leave the redaction environment. After that, it continues to be tracked and managed under our broader ISO 27001 information security management system, where it is analyzed by approved AI tools and infrastructure from Microsoft, OpenAI, Google, and Anthropic that Waterfield has vetted.
Restricted data
Never sent to AI without written authorization: secrets, card data, health data, or anything you flag.
We will not input or process the following using any AI tool, including approved AI, without your explicit written authorization: passwords, API keys, private keys, tokens, payment-card data, sensitive personal data including health data, or any information you have labeled "SENSITIVE INFORMATION, MUST NOT BE PROCESSED BY AI" or equivalent.
How long we keep it
180 days after the engagement by default. Earlier on request, confirmed within 14 days.
180 days from the end of the engagement by default. After that, we securely delete from primary storage and from backups consistent with our backup rotation. You can ask us to delete earlier in writing; we will confirm completion within 14 calendar days.
What we never do
No training on your data. No sharing beyond approved providers. No use for any other client.
We do not use or share your data to train, fine-tune, retrain, or improve any shared or general-purpose AI model.
We only disclose it to approved providers where needed to deliver the engagement.
We do not apply your data to work for any other client.
We do not use your data outside the engagement you signed up for.
We may retain and use generic learnings and anonymized insights derived from your data, only where it would be impossible to extract or reconstruct your confidential information from them.