Compliance Center
How Mission Control ensures regulatory compliance across regions
TCPA
Telephone Consumer Protection Act. DNC list enforcement, consent tracking, call time restrictions.
GDPR
General Data Protection Regulation. Data minimization, right to erasure, consent management, DPA available.
CCPA/CPRA
California Consumer Privacy Act. Right to know, delete, opt-out. No sale of personal information.
STIR/SHAKEN
Caller ID authentication via Telnyx. Full attestation (A-level) for outbound calls.
CAN-SPAM
Email compliance. Unsubscribe links, sender identification, no misleading headers.
TSR
Telemarketing Sales Rule. Calling hour restrictions, DNC compliance, disclosure requirements.
Telephony Compliance
- DNC Enforcement: Global and per-organization Do-Not-Call lists. Automatic blocking before every dial. DND (Do Not Dial) disposition auto-adds to blocklist.
- Calling Hours: Configurable per-timezone calling windows. Default: 8am-9pm local time.
- Caller ID: STIR/SHAKEN attestation via Telnyx. No spoofing. Dedicated DIDs per SDR for traceability.
- Call Recording Consent: Configurable per-campaign. Users responsible for compliance with state-level consent laws.
- AMD Transparency: Answering Machine Detection clearly labeled in call metadata. Not used to circumvent consent.
- Smart DID Rotation: Region-based caller ID matching. Volume caps (50 calls/DID/day) prevent spam flagging.
Data Protection
- Encryption: TLS 1.3 in transit, AES-256 at rest.
- Access Control: Role-based (Admin, Manager, SDR). Audit logging for all data access.
- Data Residency: US-based hosting (GCP us-central1). EU data processing available upon request.
- Data Processing Agreement: Available for enterprise customers. Covers GDPR Article 28 requirements.
- Sub-Processors: Telnyx (telephony), Clerk (auth), OpenAI (AI), Pusher (real-time), PostgreSQL (database). Full list available upon request.
- Data Retention: Configurable per-organization. Default: 90 days for recordings, 2 years for metadata.
GDPR Specific
- Lawful Basis: Contract performance (Platform users), Legitimate interest (B2B outreach), Consent (recordings, cookies).
- Data Subject Rights: Access, rectification, erasure, portability, restriction, objection. Submit via Opt-Out page.
- International Transfers: Standard Contractual Clauses (SCCs) for EU-US data transfers.
- DPIA: Data Protection Impact Assessments conducted for high-risk processing activities.
- DPO: Contact dpo@datafrontier.co for GDPR inquiries.
Regional Compliance
| Region | Regulation | Status |
|---|---|---|
| United States | TCPA, TSR, CAN-SPAM, CCPA/CPRA, State DNC laws | Compliant |
| European Union | GDPR, ePrivacy Directive, EU AI Act | Compliant |
| United Kingdom | UK GDPR, PECR, ICO guidelines | Compliant |
| Canada | PIPEDA, CASL, CRTC DNC | Compliant |
| Australia | Privacy Act, Do Not Call Register, Spam Act | Supported |
| India | DPDP Act 2023, TRAI DNC | Supported |
Policy Documents
Contact
Compliance: compliance@datafrontier.co | DPO: dpo@datafrontier.co | Legal: legal@datafrontier.co