Skip to content

Security, Compliance, and Data Governance

This chapter outlines the security and governance practices recommended for running MiaRec Conversation Analytics as a multi-tenant platform.

Because deployments vary (partner-hosted vs SaaS), treat this section as a framework and fill in the exact controls supported by MiaRec.

Security goals (operator)

  • Ensure strict tenant isolation
  • Protect sensitive data (audio, transcripts, message threads)
  • Control and audit administrative changes (tasks, fields, engines, overrides)
  • Meet regulatory requirements (retention, privacy, residency) where applicable

Identify and document: - content types stored: - audio recordings (voice) - transcripts / threads - AI outputs (custom fields, explanations) - sensitive fields: - personally identifiable information (PII) - payment data (PCI) - health data (HIPAA) (if applicable) - where data flows externally (transcription providers, LLM providers)

Access control model

Recommended role categories: - Platform operator / system admin - Tenant admin - Supervisor / analyst - Agent / standard user - Read-only auditor (optional)

Best practices: - least privilege for each role - separate operator accounts from tenant accounts - MFA/SSO enforcement for admin roles - API keys scoped by tenant and purpose

Audit logging (must-have)

Log and retain changes to: - AI Engines configuration - Global AI Tasks and Custom Fields - Tenant activation of tasks - Tenant overrides (prompt/filter) - Retention settings - User/role changes

Include: - who changed it - what changed (before/after) - when it changed - which tenant(s) are impacted

Data retention and deletion

Document: - retention defaults (audio, transcripts, threads, AI outputs) - configurable per-tenant retention (if supported) - deletion workflows and evidence (audit records) - legal hold and export mechanisms (if applicable)

Data residency and third-party processing

If you use external providers: - document what data is sent (full transcript? metadata? both?) - document provider regions and data handling guarantees - document how to select region-specific engines (if supported)

PII handling and redaction (common patterns)

Depending on product capabilities: - Pre-ingestion redaction (redact before MiaRec receives data) - Post-transcription redaction (redact in transcripts) - Prompt-level redaction (remove sensitive data before sending to LLM) - Storage-level controls (encrypt fields, restrict visibility)

Governance for AI configuration

Because AI Tasks can materially change outputs: - establish a policy for global task changes (review + test + staged rollout) - track tenant overrides as “configuration drift” - document how model changes affect comparability over time

Implementation notes

  • Provide a "Data Flow" diagram for voice and text channels showing all external processors
  • Require audit logs for task/prompt overrides (high value for enterprise customers)
  • Provide default retention settings that partners can tune per tenant
  • Document what data is sent to LLM providers (typically: transcript content with optional metadata)
  • Contact MiaRec for details on specific compliance certifications and data handling practices

EDITOR NOTE: fill in with product specifics

Purpose of this section

Provide operators a security checklist and clarify data processing boundaries (especially for external LLM providers).

Missing / unclear (confirm with Security/Engineering)

  1. Tenant isolation mechanism
  2. A) Shared DB with tenant_id enforcement
  3. B) Separate DB/schema per tenant

  4. C) Hybrid

  5. Encryption

  6. At rest: A) Yes B) No C) Depends on storage

  7. In transit: A) TLS everywhere B) Partial

  8. Audit logs

  9. A) Full config audit log exists in product
  10. B) Partial (only some actions)

  11. C) External logging only

  12. PII redaction

  13. A) Built-in redaction exists (configurable)
  14. B) Must be handled upstream

  15. C) Mixed

  16. LLM data sending

  17. A) Full transcript is sent to provider
  18. B) Transcript + metadata
  19. C) Redacted transcript only

  20. D) Configurable

  21. Compliance targets

  22. A) SOC 2
  23. B) GDPR
  24. C) HIPAA
  25. D) PCI
  26. E) Other