CallMerlin Trust Center

Privacy policy and Data Processing Agreement (Art. 28) are public. Transfers outside the EEA only with appropriate safeguards (such as SCCs or the DPF). See the privacy policy and DPA.

Account and platform data on Google Cloud in the EU (Netherlands). Chat, voice, transcripts and shared files may be sent to our AI subprocessor (xAI/Grok) for inference. That is a transfer outside the EEA with contractual safeguards, not an EU-only claim. Details in the privacy policy.

AES-256-GCM for credentials, TLS in transit, PIN + 2FA, server-side permissions.

Listed on the CSA STAR Registry for CallMerlin (Small Guy B.V.). Transparency, not a third-party audit.

Listed on the CSA STAR Registry (genAI Application Provider). Transparency for AI controls, not a third-party audit.

On the roadmap after STAR Level 1. Not certified yet.