> Sellence for security reviewers: SOC 2 Type II, HIPAA, data in AWS Frankfurt, pseudonymized identifiers before any model, TCPA consent and opt-out handling.

Canonical: https://www.sellence.com/security

Title: Security & Compliance | Sellence

Security & Compliance

# Evidence First. Gaps Named.

What Sellence has in place for a security, privacy or compliance review. The SOC 2 Type II report, where data lives, tokenization before any model, and how consent and opt-outs run. Every control Sellence holds, with its status. Nothing is claimed that is not in place.

[Book a Demo](https://www.sellence.com/demo) [Request the Security Pack](mailto:dan@sellence.com?subject=Sellence%20security%20review) [Open the Trust Center](https://trust.sellence.com)

Assurance SOC 2 Type II Data at rest AWS Frankfurt Trust center trust.sellence.com

On This Page

1. Evidence
2. Data and Infrastructure
3. The Model and Its Providers
4. Messaging Compliance
5. Privacy and Data Rights
6. Where We Stand
7. Questions Reviewers Ask

## 01 Start with the Evidence.

### SOC 2 Type II

Independent examination against the Security trust services criteria. Audit period August 4 to November 3, 2025. Report issued May 7, 2026 by Johanson Group. Clean opinion, no exceptions noted.

Full report under NDA SOC 3 summary public [trust.sellence.com](https://trust.sellence.com)

- Penetration Testing A 2026 penetration test is listed on the trust center. Results are available for your evaluation on request.

Available

- GDPR Processor Data Processing Addendum incorporating the 2021 EU Standard Contractual Clauses, an Article 30 processing register and annual risk assessments.

In Place

- Cyber Insurance Cybersecurity insurance maintained.

In Place

- Trust Center The live control list, subprocessor list and documents sit at trust.sellence.com. Reviewers request access there.

Public

## 02 Clear Facts. Defined Controls.

Data at Rest AWS eu-central-1, Frankfurt, Germany. Encrypted in transit and at rest.

Access Unique production database authentication. Encryption key access restricted.

Backups Encrypted database with point-in-time recovery and a nightly logical export.

Continuity Business continuity and disaster recovery plans established and tested.

Integration One-way by default. You push webhook events to Sellence. We hold no credentials into your systems unless you configure write-back.

Sending Messages leave under your own credentials: your Twilio account or WhatsApp Business Account, your number.

Audit Trails Consent Controls Human Oversight Access Controls Data Protection Incident Response

Breach notification within 48 hours under the Data Processing Addendum.

## 03 The Model and Its Providers.

### Identifiers Never Reach a Model

Direct identifiers, meaning names, phone numbers and contact details, are replaced by tokens before anything reaches a reasoning model. A residue guard blocks any outgoing message that still carries a masking token. This is pseudonymization. We do not describe it as anonymization.

### Model-Provider Controls

We review model-provider security attestations as part of vendor management. Ask for the security pack to review provider terms and data use for your deployment. Inference can be pinned to a single region and the cross-vendor fallback disabled if you require one provider.

### Subprocessors

| Provider | Role | Region |
| --- | --- | --- |
| Amazon Web Services | Hosting and storage | Frankfurt, Germany |
| OpenAI | Model inference | USA |
| Google Gemini | Model inference | USA |
| Anthropic | Model inference | USA |
| Twilio | SMS delivery | Your account |
| Meta Cloud API | WhatsApp delivery | Your account |
| Cloudflare | Edge and network | Global |

The current list is published on the trust center. You may object to a new subprocessor within the notice period set in the Data Processing Addendum.

## 04 TCPA, Consent and Opt-Outs.

US texting is governed by the TCPA, state law and the carriers. The program below is how Sellence keeps every message inside those rules.

- Consent Stays with You Sellence messages only the contacts you supply, with their consent status. No purchased or generated lists. During onboarding we help you build the opt-in form with the required disclosure language, at no cost.

Standard

- Opt-Out Is Instant, and It Sticks STOP, QUIT, UNSUBSCRIBE, CANCEL, END and other clear requests are honored on the spot and suppressed across every campaign and channel. They are written back to your system of record and never reversed without a new explicit opt-in. You receive a daily opt-out digest.

Standard

- Quiet Hours Send windows are enforced in the recipient's local time, measured by area code.

Standard

- Registered Traffic Brand and campaign are registered with The Campaign Registry under the A2P 10DLC standard. Your brand name appears in every message.

Standard

- Audit Trail Every opt-out is timestamped and logged. Consent status is on file for each contact.

Standard

- Outside Counsel Sellence works with outside counsel on the SMS compliance program. Compliance questions go to compliance@sellence.com.

Retained

This page describes how Sellence approaches messaging compliance. It is informational and is not legal advice. Each brand remains responsible for obtaining and maintaining valid consent, and should consult its own counsel before launching a messaging program.

## 05 Privacy and Data Rights.

| Retention | Conversation history is kept for the life of the contract. The model's per-turn history window is a configurable setting. Retention and deletion follow the Data Processing Addendum. |
| --- | --- |
| Erasure | Per-contact erasure is supported during the term. At termination, all personal data processed on your behalf is deleted or returned, unless the law requires retention. |
| Data Subject Requests | Sellence assists you and forwards any request it receives directly. It never answers a data subject on its own. |
| CCPA | Under the Data Processing Addendum, Sellence acts as a service provider: no sale or sharing of personal data, no retention, use or disclosure outside the services, and no combining with data from other sources. |
| Website Visitors | Covered by the Privacy Policy. Service data is governed by the Data Processing Addendum, available on request. |

## 06 What We Hold. What We Do Not.

Certifications we hold, and the ones we do not yet hold, in one place.

- SOC 2 Type II Security criteria. Report issued May 7, 2026, no exceptions.

Held

- Penetration Test 2026 Listed on the trust center.

Done

- GDPR Processor DPA 2021 EU Standard Contractual Clauses, Article 30 register, annual risk assessments.

In Place

- HIPAA Policies signed in July 2026 and the HIPAA program is complete. Sellence is HIPAA compliant.

In Place

- ISO 27001 Sellence does not hold ISO 27001. The cloud and model providers we rely on hold their own SOC 2 or ISO 27001 attestations, reviewed in vendor management.

Not Held

## 07 Questions Reviewers Ask.

**Does Sellence have a SOC 2 report?**

Yes. Sellence holds a SOC 2 Type II report against the Security trust services criteria. The audit period ran from August 4 to November 3, 2025. The report was issued on May 7, 2026 by Johanson Group, with no exceptions noted. The full report is available under NDA through trust.sellence.com. A SOC 3 summary is public.

**Can our compliance team export the audit trail for a regulator or a sponsor bank?**

Yes. Every message, consent record and opt-out is timestamped and logged. The audit trail exports for a market conduct exam, an FCA review or a sponsor bank audit.

**Where is our data stored?**

All data at rest sits in AWS eu-central-1 (Frankfurt, Germany), encrypted in transit and at rest. Model inference can be pinned to a single region and the cross-vendor fallback disabled if you require one provider.

**How is customer data handled by the model?**

Direct identifiers such as names, phone numbers and contact details are replaced by tokens before they reach a reasoning model. A residue guard blocks outgoing messages that still carry a masking token. This is pseudonymization. Request the security pack to review model-provider terms and data use for your deployment.

**Who owns SMS consent, and what happens when someone texts STOP?**

Consent stays with you. Sellence messages only the contacts you supply, with their consent status, and never purchased or generated lists. STOP, QUIT, UNSUBSCRIBE, CANCEL, END and other clear requests are honored on the spot and suppressed across every campaign. They are written back to your system of record and never reversed without a new explicit opt-in. Every opt-out is timestamped and logged.

**What happens to our data when the contract ends?**

At termination, all personal data processed on your behalf is deleted or returned, unless the law requires retention. During the term, per-contact erasure is supported and data subject requests are forwarded to you and assisted; Sellence never answers a data subject on its own.

**Is Sellence HIPAA or ISO 27001 certified?**

HIPAA, yes. Policies were signed in July 2026 and the HIPAA program is complete; Sellence is HIPAA compliant. Sellence does not hold ISO 27001. The cloud and model providers it relies on hold their own SOC 2 or ISO 27001 attestations, which are reviewed in vendor management.

Your Next Step

## Bring Your Reviewer to the First Call.

We walk through the SOC 2 report, data flows and the consent model for the journey you have in mind.

[Book a Demo](https://www.sellence.com/demo) [Request the Security Pack](mailto:dan@sellence.com?subject=Sellence%20security%20review)