Charlotte’s compliance posture, in plain language.
Trades operators carry a lot of regulatory surface area: TCPA, BIPA, 13 all-party-consent recording states, 10DLC SMS, contractor-licensing- board audit windows, FTC and CCPA-equivalent data rights. This page documents exactly how Charlotte handles each one, with links to the authoritative source so you can verify.
How Charlotte handles each regulatory surface
Q1Does Charlotte comply with TCPA for AI-generated voice?
Yes. The FCC's February 2024 declaratory ruling classifies AI-generated voice as artificial-voice under TCPA, requiring disclosure at call start. Every Charlotte call opens with the spoken disclosure I'm Charlotte, an AI assistant — this call is recorded. A nightly compliance regression suite transcribes each prior-day recording and asserts the disclosure phrase appears within the first eight seconds; CI fails on any miss.
Q2How does Charlotte handle the 13 all-party-consent recording states?
The same in-call recording disclosure satisfies all 13 all-party-consent states: California, Connecticut, Delaware, Florida, Illinois, Maryland, Massachusetts, Michigan, Montana, Nevada, New Hampshire, Pennsylvania, and Washington. Charlotte picks a state-specific disclosure variant from the triage-prompt set based on the caller's area code, so a Florida caller hears the state-appropriate phrasing automatically. Federal one-party-consent baseline applies everywhere else.
Q3Is Charlotte's BIPA posture safe for Illinois callers?
Yes. Illinois BIPA covers biometric identifiers including voiceprints. Charlotte ships with voiceprint diarization disabled by default via the feature flag CHARLOTTE_VOICEPRINT_DIARIZATION_ENABLED=false. The flag cannot flip to true for any tenant without an explicit compliance_consents row carrying consent_type=bipa_voiceprint. No voice biometric data is collected, stored, or processed in the default product configuration — the safest baseline for Illinois operators.
Q4What happens to a call recording after the call ends?
Call recordings are retained for thirteen months by default. Each business can configure its own retention window between one and eighty-four months, and the same window applies to every recording for that business — retention is a per-business policy, not a per-call one. Recordings are encrypted at rest, playback links expire after five minutes, and deletion requests are honored through the data-deletion process described in our privacy policy.
Q5Does Charlotte support data export and deletion rights?
Yes. Every tenant has on-demand FTC and CCPA-equivalent export plus deletion rights. The admin portal exposes an Export tenant data action returning a ZIP with all tables and a recordings index, and a Delete tenant action that soft-deletes data immediately and purges it after a 30-day recovery window. Audit-log entries with no personally identifiable information are retained seven years to satisfy SOC2.
Q6Where does Charlotte's call data live?
All tenant data — call recordings, transcripts, CRM-synced records, audit log — is stored in US-region cloud infrastructure: the primary database on Neon (AWS US East), recordings in Cloudflare R2 encrypted with AWS KMS-backed envelope keys, and TLS in transit. No data leaves the United States in normal operation. The full vendor sub-processor list is published in the privacy policy at /legal/privacy and updated when a sub-processor onboards.
Q7How does Charlotte handle 10DLC SMS compliance?
Outbound SMS runs on Telnyx. 10DLC Brand verification is complete; Campaign registration is in progress and is required before reply messages (STOP and HELP confirmations) actually reach customers. Per-tenant consent gates every send — the outbound pipeline checks the active SMS-consent row in compliance_consents before invoking Telnyx. Inbound STOP, START, and HELP keywords land on a webhook and update the consent ledger atomically with the audit row even before the campaign is live; outbound reply messages skip with an audit row until the campaign goes live, so a customer's STOP still revokes consent immediately even if they don't yet receive the unsubscribed confirmation.
Q8Can a customer's STOP silence operator paging too?
No — and that's intentional. Compliance consents partition by subject_type: customer covers caller SMS, operator covers operator paging and the weekly digest, caller covers the in-call disclosure audit anchor. A customer's STOP writes a customer-namespace revocation; operator paging looks up operator-namespace rows by the operator's email and proceeds unaffected. Treating these as one namespace would turn any customer STOP into a tenant-wide page outage.
Q9Is Charlotte SOC2 certified?
Charlotte's posture is SOC2-ready with continuous evidence collected through Vanta from Phase 0 Week 1. Full SOC2 Type 2 certification takes a multi-month audit cycle and is not a launch blocker — but every control SOC2 measures (access management, encryption, change management, monitoring, vendor risk) is in place and continuously evidenced. A penetration test through Cobalt or Bishop Fox closes the cycle pre-launch.
Q10Where can I find Charlotte's privacy policy and TOS?
The privacy policy lives at /legal/privacy, terms of service at /legal/tos, SMS messaging terms at /legal/sms-terms, the BIPA biometric-information notice at /legal/bipa-notice, and the call-recording disclosure at /legal/recording-disclosure. The privacy policy, terms of service, and SMS terms are dated and version-controlled in packages/legal-text. The compliance page footer carries the last-reviewed timestamp that ties to the dateModified field in the page's WebPage JSON-LD.
The 13 US states that require all-party consent
Charlotte’s in-call recording disclosure satisfies the all-party-consent rule in each of these states. The disclosure is played in the caller’s language (English or Spanish) before the conversation begins; the caller’s area code drives a state- specific phrasing variant where the statute requires it.
- CaliforniaCA
- ConnecticutCT
- DelawareDE
- FloridaFL
- IllinoisIL
- MarylandMD
- MassachusettsMA
- MichiganMI
- MontanaMT
- NevadaNV
- New HampshireNH
- PennsylvaniaPA
- WashingtonWA
Authoritative sources cited on this page
- FCC TCPA AI-generated voice ruling (Feb 2024)— Federal Communications Commission's Feb 2024 declaratory ruling that AI-generated voice qualifies as artificial-voice under TCPA — Charlotte's in-call disclosure satisfies this.
- FTC Telemarketing Sales Rule— Federal Trade Commission's rule on telephone sales and outbound SMS — drives Charlotte's per-tenant opt-in flow.
- Illinois BIPA full text (740 ILCS 14)— Illinois Biometric Information Privacy Act — the statute governing voiceprint diarization (kept off by default in Charlotte).
- California AB 2905 (AI-disclosed phone calls)— California's 2024 AI-robocall disclosure law — Charlotte uses tightened phrasing for California area codes.
- NAIC consumer-protection model laws— National Association of Insurance Commissioners — referenced for cross-state consumer-protection frameworks Charlotte's compliance posture aligns with.
- FCC 10DLC compliance overview— FCC's posture on 10DLC SMS and consumer protection — drives Charlotte's Telnyx 10DLC Brand + Campaign registration.
- California Public Utilities Commission— Sample state-level utility regulator — Charlotte's compliance page links to each state's PSC for homeowners to verify state-specific recording-disclosure rules.