Security & compliance · AcuCall CenterMaster

THE FACTS, BLOCK BY BLOCK

What we do, before what the law says

CenterMaster is built to support your TCPA / HIPAA / PCI obligations. Compliance comes from how you run your campaigns; below are the controls you get and what we do on our side.

Call recording & redaction

Every call is recorded and transcribed by our own speech recognition.
Card numbers are found and masked in real-time during a call, so they are removed before anyone plays the recording back.
All Card data is masked in both audio and system logs.
Recordings are kept with no set time limit by default.

Payments (PCI)

Card numbers spoken on a call are redacted from the recording in real-time.
Credit card information, card number, expiration date, cvv code, etc., are never stored in recordings.
We are PCI DSS compliant (AOC/SAQ-D)

Healthcare (HIPAA)

Health details are masked in recordings automatically.
Voicemail and text scripting guidance: a message says who's calling and how to call back, never what the treatment is.
Minimum necessary: scripts and prompts carry only what the contact needs.

Outbound (TCPA & carriers)

Four dialing modes — predictive, progressive, power and preview — and you set the number of calls and texts per hour.
Calling groups, each dialing only inside its own local-time schedule. Retry caps and DNC scrubbing are in use.
Opt-out handling: a STOP reply suppresses the number.
Per-campaign retry limits help collections clients stay within Reg F call-frequency limits.
Outbound calls are signed and attested under STIR/SHAKEN.
Number registration with the carriers: toll-free and 10DLC, under AcuCall or under your own business documents, depending on the case.

Access & operations

Separate roles for admins, supervisors and agents; dashboards follow admin and supervisor privileges.
Hosted on AcuCall's own internal servers, call recordings included.
Regular independent audits and certifications.
Support by people: Mon–Fri 8:00–23:00 ET, Sat–Sun 8:00–20:00 ET.

Your data

Routine secure data transfers and API access through our Reporting Services.
Custom reports and data feeds built by the same team.
Deletion on request.

LAWFUL OUTREACH ONLY

Responsible use

We work with lawful outreach only. We'll ask about consent basis before a campaign launches; if the answer isn't good, we won't send.

Technology moves faster than the law, and the fines land on the sender: calls outside 8 a.m.–9 p.m., repeated calls at $500 each, a voicemail that names a prescription. We'd rather lose a campaign than run one that puts you — or the people on your list — on the wrong side of those rules.

Questions we hear

Are card numbers ever stored?

Not in recordings or transcripts: redaction removes them. Capture the payment in the IVR or ITR and the agent never hears the number either.

Can you show us your security documentation?

On request, under NDA. Ask an expert and we'll tell you what we can share.

What happens if we ask you to delete our data?

Ask us directly and a person will walk you through it.

Ask us the hard questions.

Ask our team a compliance question — consent basis, recordings, card data, BAAs. You'll get an expert, not a script.

Talk to an expert Call (855) 799-7905

What we do about the rules.