Security, compliance, and AI governance
Bibha, the company behind PeachDesk, is ISO 27001 certified and SOC 2 Type 1 and Type 2 attested. The controls behind GDPR, ISO/IEC 42001, and the EU AI Act are implemented and operating across the platform today, with final independent audits underway and every status published live at the Bibha AI Trust Center. Teams that want call data inside their own perimeter can self-host PeachDesk behind their own identity and compliance stack.
Bibha, the company behind PeachDesk, is ISO 27001 certified and SOC 2 Type 1 and Type 2 attested. The controls behind GDPR, UK GDPR, ISO/IEC 42001, and the EU AI Act are implemented and operating today, with final independent audits in progress. Every status, with its evidence, is published live at the Bibha AI Trust Center.
Attested and certified
Bibha is certified to ISO 27001, the globally recognized standard for establishing, implementing, maintaining, and continually improving an information security management system. The certification covers the ISMS behind the platforms we build and operate, including PeachDesk.
Bibha holds a SOC 2 Type 2 report, the AICPA attestation standard for service organizations. The audit examines how our controls operate over time across all five Trust Services Criteria: security, availability, processing integrity, confidentiality, and privacy.
SOC 2 Type 1 report also available at the Trust Center.
Controls in place, final audits in progress
Every technical control GDPR expects of a voice AI platform is in place and operating: per-agent retention windows with automated purge, call data in storage you control, telemetry off by default. The final independent audit is underway.
The same operating controls extend to the UK's data protection requirements, run as a parallel programme alongside the EU GDPR work, with its final audit underway.
Our AI management system, covering AI governance, risk management, and the responsible operation of AI systems, is implemented and running today. The final certification audit is in progress.
The EU's risk-based AI regulation maps directly onto how PeachDesk already operates: documented AI governance, human control over every agent, and disciplined data handling. Final conformity work is underway.
Compliance status changes as audits complete, so this page does not carry dates or promises. For the live register and the evidence behind each attestation, visit the Bibha AI Trust Center.
Governance at PeachDesk is how the platform runs, not a policy PDF. Our AI management system operates in line with ISO/IEC 42001 and the EU AI Act, and the data privacy controls behind GDPR and UK GDPR ship in every deployment, hosted or self-hosted.
Your customer
Phone or browser call
PeachDesk voice AI
Agents, telephony, orchestration
Storage you control
MinIO or S3, signed time-limited URLs
Every control below ships in the PeachDesk codebase today. The Bibha AI Trust Center monitors the wider programme beyond the product, including corporate and endpoint controls, and publishes live status.
Controls reviewed against the codebase: August 2026.
Controls evolve as the codebase does; the live, continuously monitored view of the wider programme is on the controls tab of the Bibha AI Trust Center.
Bring-your-own-keys is a security boundary, not just a billing option. When you connect your own telephony and model provider accounts, the credentials are encrypted at rest with Fernet (AES-128 with HMAC authentication), usage is billed directly by your provider, and PeachDesk never meters, throttles, or gates those calls. Your spend and your provider relationship stay between you and them. See how voice AI BYOK works.
Security reviews move faster when both sides work from evidence. Three ways to engage us directly.
Yes. Bibha, the company behind PeachDesk, maintains SOC 2 Type 2 compliance across security, availability, processing integrity, confidentiality, and privacy. The report and the controls behind it are published at the Bibha AI Trust Center. In the product, those controls are verifiable in code: tenant isolation guarded by a CI test, credentials encrypted at rest, and signed webhooks on every call event.
Yes. Bibha, the company behind PeachDesk, is certified to ISO 27001 for its information security management system. ISO 27001 is the global standard for establishing, maintaining, and continually improving an ISMS, and the certificate is available at the Bibha AI Trust Center. Bibha also holds SOC 2 Type 1 and SOC 2 Type 2 reports, available at the Trust Center.
PeachDesk ships every technical control GDPR expects of a voice AI platform, and Bibha's final GDPR audit is in progress, tracked live at the Bibha AI Trust Center. UK GDPR runs as a parallel programme. The controls are visible in the product: configurable per-agent retention with automated purge, call recordings and transcripts in storage you control, and telemetry that stays off unless you turn it on.
Bibha operates an AI management system aligned with ISO/IEC 42001, the international standard for managing AI responsibly, with the final certification audit in progress. EU AI Act readiness runs as a parallel programme, and both are published at the Bibha AI Trust Center. In the product, your team defines every agent's behaviour, telemetry is off by default, and optional traces route to your own Langfuse project.
In object storage the deployment controls, served through signed, time-limited URLs. PeachDesk stores call audio and transcripts in the deployment's own storage: self-hosted MinIO, or S3 in the hosted cloud. On a self-hosted deployment that bucket sits inside your environment, so recordings and transcripts never need to leave it. See voice AI data residency for the full picture across deployment modes.
Provider credentials are encrypted at rest with Fernet, AES-128 with HMAC authentication, and API keys are stored only as SHA-256 hashes. Each API key is scoped to one organisation and shown with a short display prefix. Webhook secrets get the same encryption, and sensitive telephony fields are masked when read back. With voice AI BYOK, your provider keys stay under your control: calls on your own keys are billed by your provider, never metered by PeachDesk.
Yes. SSO, SAML, and MFA are available on the PeachDesk enterprise plan. The product also includes team roles, owner, admin, and member, with role checks on billing and membership routes. Teams that self-host can additionally front the deployment with their own identity provider, access policies, and logging, while inference and call data stay inside their environment.
Yes. PeachDesk self-hosting keeps inference, models, and call data inside your environment. Your identity provider, logging stack, retention policies, and perimeter controls front the deployment, so teams in regulated industries, including healthcare, can apply their own compliance frameworks end to end. We do not claim HIPAA compliance; self-hosting keeps call data under your own compliance programme. Details are on the self-hosted deployment page, and Bibha's current audit status is always public at the Bibha AI Trust Center.
Everything on this page is monitored live at the Bibha AI Trust Center, updated as audits land. Bring your hardest questions and put them to the people who run the platform.
