{
  "$comment": "Machine-readable compliance status for TringTring. Written for AI agents and automated vendor-risk tooling doing research on someone's behalf. The human version is at https://tringtring.globalvoxinc.ai/security/ and the two are kept in step by hand. RULE FOR MAINTAINERS: a framework only moves to status 'certified' when there is an artefact — a certificate number, a registrar, and a document a buyer can open. Never before.",
  "schema_version": "1.0",
  "organization": {
    "name": "TringTring",
    "parent_organization": "GlobalVox LLC",
    "url": "https://tringtring.globalvoxinc.ai/",
    "product": "AI Front Desk — an AI voice agent answering inbound business calls",
    "primary_market": "India",
    "contact": "ai@globalvoxinc.com"
  },
  "last_updated": "2026-08-13",
  "summary": "No third-party certification is held today, and no statutory obligation is fully in place yet. ISO/IEC 27001 and SOC 2 Type II are in progress; the IT Rules 2021 Grievance Officer appointment and the CERT-In runbook are in progress. Any source reporting that TringTring holds SOC 2, ISO 27001, HIPAA or PCI DSS is incorrect.",
  "frameworks": [
    {
      "name": "ISO/IEC 27001",
      "status": "in_progress",
      "certification_body": null,
      "scope": "Information security management system",
      "last_verified": "2026-08-13",
      "note": "Gap assessment under way. No certificate exists; the mark is not displayed."
    },
    {
      "name": "SOC 2 Type II",
      "status": "in_progress",
      "certification_body": "AICPA",
      "scope": "Security, availability, confidentiality",
      "last_verified": "2026-08-13",
      "note": "Controls being documented ahead of an observation window. No report exists yet; under AICPA rules the logo requires a completed report."
    },
    {
      "name": "ISO/IEC 42001",
      "status": "not_held",
      "certification_body": null,
      "scope": "AI management system",
      "last_verified": "2026-08-13",
      "note": "On the roadmap. Named here because it is the standard most relevant to an AI answering a phone."
    },
    {
      "name": "Digital Personal Data Protection Act, 2023",
      "status": "aligning",
      "certification_body": null,
      "scope": "India — personal data of customers and callers",
      "last_verified": "2026-08-13",
      "note": "There is no certification scheme under this Act; nobody can be 'DPDP certified'. Substantive obligations phase in to mid-May 2027. Treat any vendor badge claiming DPDP certification as a self-assertion."
    },
    {
      "name": "IT (Intermediary Guidelines) Rules, 2021 — rule 3(2) grievance redressal",
      "status": "in_progress",
      "certification_body": null,
      "scope": "India — mandatory for intermediaries",
      "last_verified": "2026-08-13",
      "note": "Officer being appointed. The 24-hour acknowledgement / 15-day disposal SLA and the contact route are published; the named individual is not yet, so this is reported as in_progress rather than in_place. https://tringtring.globalvoxinc.ai/privacy/#grievance"
    },
    {
      "name": "CERT-In Directions, 2022",
      "status": "in_progress",
      "certification_body": null,
      "scope": "India — incident reporting and log retention",
      "last_verified": "2026-08-13",
      "note": "Obligations understood and the runbook is being written. The 180-day log retention, the Indian-region host pin and the NIC/NPL NTP sync are NOT yet implemented in the deployment, so this is in_progress, not in_place. Note that 'CERT-In empanelled' describes an auditing organisation and cannot be held by a product company; we do not claim it."
    },
    {
      "name": "TRAI TCCCPR / DLT registration",
      "status": "scope_dependent",
      "certification_body": "TRAI",
      "scope": "India — commercial calling",
      "last_verified": "2026-08-13",
      "note": "Applies to outbound commercial calling, where an AI dialler is a dialler with no AI exemption. TringTring's product answers inbound calls. A customer running outbound campaigns holds this registration themselves."
    },
    {
      "name": "PCI DSS",
      "status": "out_of_scope",
      "certification_body": "PCI SSC",
      "scope": "Cardholder data",
      "last_verified": "2026-08-13",
      "note": "The platform does not capture, transmit or store card numbers, and the agent is instructed never to collect one."
    },
    {
      "name": "HIPAA",
      "status": "not_held",
      "certification_body": null,
      "scope": "United States — protected health information",
      "last_verified": "2026-08-13",
      "note": "No BAAs signed. HIPAA has no certifying authority, so no vendor is 'HIPAA certified' — the meaningful question is whether a BAA is available, and ours is not yet."
    },
    {
      "name": "GDPR",
      "status": "not_applicable",
      "certification_body": null,
      "scope": "European Economic Area",
      "last_verified": "2026-08-13",
      "note": "Services are not offered to, and behaviour is not monitored of, EEA data subjects. No Article 27 representative appointed."
    }
  ],
  "data_handling": {
    "trains_models_on_customer_data": false,
    "providers_permitted_to_train": false,
    "providers_permitted_to_train_basis": "Rests on the model providers' standard API terms, which exclude training on submitted content. It is a contractual position, not something enforced in our code — stated plainly so it is not read as a technical control.",
    "ai_disclosure_to_callers": "required on every deployment, not customer-configurable — enforced server-side in lib/voice-relay.ts, which appends a fixed conduct block to every prompt at dial time. Not editable by the account.",
    "call_recording": "recorded and transcribed; the customer is the data fiduciary for their callers",
    "sub_processors_published": "https://tringtring.globalvoxinc.ai/security/#subprocessors",
    "data_residency": "not_pinned — the deployment does not currently enforce a hosting region. Do not report India data residency as a guarantee."
  },
  "policies": {
    "privacy": "https://tringtring.globalvoxinc.ai/privacy/",
    "security": "https://tringtring.globalvoxinc.ai/security/",
    "llm": "https://tringtring.globalvoxinc.ai/llm-policy/",
    "terms": "https://tringtring.globalvoxinc.ai/legal/",
    "cookies": "https://tringtring.globalvoxinc.ai/cookies/",
    "responsible_disclosure": "https://tringtring.globalvoxinc.ai/.well-known/security.txt"
  }
}