Data security in Leksta

Where your data is stored

• The cloud edition of Leksta runs on servers in Belarus, in a data centre in Minsk.
• Call recordings are kept in our own object storage on those servers; transcripts and scores sit in Leksta databases.
• Each customer's data is isolated from other customers' data.
• Need a closed perimeter? We can install Leksta on your own servers.

What is stored and for how long

• Leksta processes the recordings you connect from your PBX or upload as files, and builds transcripts, scores and summaries from them.
• An administrator sets how long recordings and transcripts are kept for your company.
• Automatic cleanup runs once a day, and before a manual cleanup you can preview what will be deleted.
• You can delete recordings and analysis in the console at any time.
• After the contract ends you can export your data for 30 days, then it is deleted; from backups, within 60 days.

Personal data masking

• Leksta finds phone numbers, e-mails, card and document numbers by itself and masks them in transcripts.
• Only an administrator can reveal a hidden value: a reason is required, and every reveal is written to the audit log.
• By default the original values are deleted after 30 days, and you can change that period. An administrator can also choose to replace values irreversibly.

Access to data

• Console sign-in goes through Keycloak; after a series of failed attempts, brute-force protection kicks in.
• A password must be at least 12 characters, and passwords are stored only as hashes.
• Roles Operator, Supervisor and Administrator, plus custom roles: everyone sees only what they are meant to. Retention settings and revealing hidden data belong to the administrator only.

Connection security

• The site and the console work over HTTPS, and plain HTTP requests are redirected to the secure connection automatically.
• HSTS is on: the browser opens Leksta over HTTPS only.

How AI processes data

• Speech recognition runs on Leksta servers. The sub-processors that may take part in processing are listed in Appendix 1 of the Offer.
• Language model: only the transcript text is sent for analysis, never the audio. In the cloud edition the analysis is done by language models through the OpenRouter service (USA and other countries, as the data processing agreement states).
• Need fully local processing? In the on-premise edition speech recognition and the language model run on your servers; in closed mode there are no outgoing connections.

Backups

• Data, recordings and settings are backed up daily.
• Archives are encrypted, and a copy is kept on a separate server.

Documents

Full terms are in the Personal Data Processing Policy and the Public Offer; Appendix 1 of the Offer holds the data processing agreement and the list of sub-processors.