Runs where your data lives.
The same platform, three ways to host it. Regulated teams usually pick the third. We answer security questionnaires with the engineers who built the system, and we do not claim certifications we do not hold.
Three places it can run.
One bundle.
The speech models, the platform and your data ship together. Only the line around them moves: who owns the ground it stands on, and what sits inside with it.
Hosted by Kejue,
in your region.
Two territories. The bundle stands on ground Kejue operates; your phones, your people and your systems stay on yours. One connection joins them, and nothing else leaves.
- Data
- Kejue's hosting in your region, one organization per tenant
- Keys
- Each tenant encrypted under its own key, in transit and at rest
- Live in
- Days
- Phone linesYour carrier, your numbers
- Your peopleHand-offs and approvals
- Your systemsCRM, core, ticketing
- Speech modelsRecognition and synthesis
- Sonus platformAgents, guardrails, audit
- Your dataTranscripts, recordings, keys
What is enforced,
not promised.
Each of these is a setting in the dashboard and a behaviour in the call path, not a paragraph in a policy document. The screens are the real product.
Who can do what,
down to the single action.
Roles are built from a catalog of more than a hundred named permissions, one per action in the product. Owner, admin, builder and viewer come ready; your own roles sit beside them.
Reading raw caller data, promoting an agent or deploying a version are marked sensitive and are never granted by a broad role. Someone has to name them.
API keys carry an explicit list of scopes, not a role. An integration key reads what it needs and nothing else, and is stored only as a hash.
Single sign-on through your identity provider, with group-to-role mapping, accounts created on first sign-in, and the option to refuse passwords for everyone except named break-glass accounts.
Two-factor sign-in with a team policy: off, optional, or required for every member.
Two transcripts,
and a reason to open the second.
Masking covers identity numbers, card numbers, emails, phone numbers, dates of birth and policy numbers, including the way people say them out loud, plus any terms you add yourself.
The unmasked transcript and the recording are encrypted under a key that belongs to your organization alone. A copy of the database decrypts to nothing.
Opening the unmasked transcript takes a named permission and, if you choose, a written reason or a colleague's approval. Each read writes an audit entry in the same transaction.
You set how many days call content is kept. After that a worker removes transcripts, recordings and everything derived from them. One switch puts a call on legal hold; one action erases a single call on request.
Recording can be switched off per agent. Credentials for your systems live in an encrypted vault and are never shown again after they are saved.
Guardrails and handoffs,
built into the call.
Guardrails, written in plain language by your compliance team and attached to the agent.
Keypad digits are masked on every screen and in every log. A card number or PIN entered on the keypad leaves the call as a count, never as digits.
Nothing about an account is spoken until identity checks pass through your systems, and the agent can hand the call to a person, announced or direct, whenever your rules say so.
Every dial checked
before it leaves.
The do-not-call registry is checked before every outbound call, including calls already queued and the external leg of a transfer. If the registry cannot be reached, the call does not go out.
The policy is yours: off by default, on by default, or enforced so no campaign can switch it off.
Calling windows follow each contact's own time zone, with daylight saving and weekends handled, and the team's hours as a ceiling no schedule can exceed.
Retries are capped per destination, so a number that does not answer is not dialled all day.
Built so it can be
checked, not trusted.
The parts your security team will ask about after the demo.
An audit row for every change
Who changed the prompt, who listened to the raw audio, who created a key, with actor, IP address and request id. The API refuses to complete any change that did not write its audit entry, so no new feature can ship unaudited.
Signed webhooks, delivered once
Every delivery is signed with your endpoint's secret over a timestamp and the body. Secrets rotate in one click. A delivery is leased before it is sent, so a crashed worker never sends it twice.
Isolated at the database
Every table is protected by row-level security keyed to the organization, and an automated check proves a cross-tenant read returns nothing.
Signed builds
Every image is scanned for vulnerabilities, ships with a software bill of materials, and is signed by a key that only the main build pipeline can use. A feature branch cannot produce a trusted image.
No outbound dependency
Your systems, webhooks and tools are reached through a boundary that re-resolves every address and refuses private networks. Nothing about a deployment reports home.
Portable by contract
No cloud vendor code outside one adapter layer, enforced in CI. The same bundle runs in our cloud, your cloud, or your data center.
What compliance teams ask first.
Yes, cold or warm. A warm transfer briefs the human with a summary or the full transcript before the caller is connected, so nobody repeats themselves.
It is designed to sit inside the controls those regulators expect: deployment in your VPC or on-prem, data residency in-country, verification before disclosure, card data entered by keypad and never spoken, redacted transcripts, and an audit log of every action. We answer questionnaires with the engineers who built it.
Yes. Kejue connects over SIP to your existing trunks, PBX, or contact-center platform, and can also provision numbers where you need them. Inbound and outbound both run on your numbers.
Where you decide. Managed cloud in a region you choose, your own VPC, or fully on-prem. Recordings and transcripts never leave the deployment you picked.
Send us the questionnaire.
We answer it with the engineers who built the platform, and we show you the controls live.