We are committed to security, compliance, and transparency.

Legal Compliance

Amical complies with Law 25 (Quebec) and the Personal Information Protection and Electronic Documents Act (PIPEDA). It is designed according to industry best security practices aligned with SOC 2 and ISO 27001 standards, though it is not yet officially certified to date.

Phone Servers

• Secure hosting in Canada (AWS)
• Isolated VPC environment
• Multi-server redundancy via Amazon
• Full encryption of voice data, transcriptions, and identifiers (AES-256 at rest, TLS 1.3 in transit)

Administrator Portal

• Secure hosting in Canada (AWS)
• Multi-server redundancy via Amazon
• Automated hourly backups
• Passwordless client login via Supabase Auth (email one-time codes), with optional Google or Facebook OAuth
• Database encryption
• Secure transmission via TLS
• XFRS Tokens
• Automated testing processes
• HTTPS requests

No Passive Listening

No sound is captured when the handset is hung up. By default, all calls between the AI companion and the resident are recorded, whether the call is started by the user or by the AI. Calls in which the AI is not a party (for example, a relative calling the device from their own phone) are not recorded, except with written explicit consent from the relative and the residence in specific scientific studies. Clients may disable recording in their settings; doing so removes certain features and limits Amical's ability to provide support.

Data is maintained securely at all times.

Incident response overview

Amical AI's incident response plan is built on a modern, highly secure, and automated cloud-native infrastructure designed for rapid detection, immediate containment, and end-to-end data integrity.

1. Secure architecture and prevention (security by design)

Environment isolation: Our infrastructure is hosted on AWS in Canada. Production and staging are strictly isolated in dedicated AWS accounts, with centralized access management restricted to authorized Amical personnel. Immutable infrastructure (compute): Applications run on managed Kubernetes clusters (Amazon EKS) on EC2 instances using Bottlerocket, a locked-down Linux distribution optimized for containers. Administrator SSH access is disabled by design, reducing OS-level compromise risk. Secrets management: Passwords and API keys are never stored in the codebase. Sensitive credentials are managed through AWS Secrets Manager and securely injected into containers at runtime.

2. Detection and observability

Proactive monitoring: Our observability, logging, and alerting stack is centralized in Datadog. We use Datadog Watchdog to automatically identify anomalies in performance, security posture, and infrastructure behavior. Automated alerting: When Watchdog or custom monitors detect anomalies (for example error spikes, unusual traffic patterns, or unexpected behavior from US-based subprocessors such as Twilio or ElevenLabs), critical alerts are immediately escalated to the engineering team for rapid investigation.

3. Containment and recovery (GitOps approach)

Instant deployment and rollback: Infrastructure is defined as code and versioned in GitHub. CI is managed through GitHub Actions, and CD is managed by Argo CD with Helm charts. In the event of a compromised application version or container image, Argo CD can trigger an immediate rollback to a known healthy state. Third-party flow isolation: If a vulnerability or breach is detected at a subprocessor, API communications can be rapidly disabled through centralized environment controls to isolate and contain the incident.

4. Data integrity and backup (hybrid policy)

Telephony data (Amazon RDS): The database used for call flows and metadata is backed up automatically once per day with a retention period of 30 days. Application administration data (Supabase): Client configuration and administration data is backed up every 5 minutes with a retention period of 7 days. Audio file storage (Amazon S3): Recordings are stored securely with an automated lifecycle policy that transitions older files to Amazon Glacier for archival. Data is retained for up to 7 years. Upon explicit client deletion request, data is purged immediately and permanently from S3 buckets.

5. Communication and notification (SLA)

Client transparency: In the event of a confirmed security incident affecting an operator's data, Amical AI notifies designated client administrators without undue delay, and no later than 48 hours after breach confirmation. Post-incident reporting: After resolution of a critical incident, a detailed post-mortem report is made available to the client, including root cause, potentially affected data, and corrective actions deployed through our CI/CD pipelines.