At Telegent, protecting our customers’ communications is the foundation of our service. We
operate communications infrastructure that handles voice, messaging, and customer data, and
we take a layered approach to keeping that data safe.

This page summarizes how we protect customer information and the controls we have in place.
For the most current detail, contact security@telegent.com.

Compliance and certifications
Telegent is actively pursuing SOC 2 Type I attestation, with Type II to follow. Our security
program is built on the AICPA Trust Services Criteria for Security.
We use Vanta for continuous monitoring of our security controls.
To request a copy of our SOC 2 report under NDA once available, contact security@telegent.com.

Data encryption
In transit. All customer data transmitted to and from Telegent services is encrypted using TLS
1.2 or higher. Internal service-to-service communication within our production environment is
also encrypted in transit.
At rest. Customer data stored in our systems is encrypted at rest using industry-standard
algorithms (AES-256). Encryption keys are managed by Azure Key Vault and rotated according
to provider best practices.

Infrastructure security
Telegent’s production infrastructure is hosted on Microsoft Azure, which maintains SOC 2, ISO
27001, and other industry compliance certifications. We inherit the physical and environmental
security controls of Microsoft’s data centers.
Customer data is processed and stored in Azure data centers located in the United States.
Our infrastructure is logically segmented, with production environments isolated from
development and corporate networks. Network traffic is controlled through Azure network
security groups and firewall rules following least-privilege principles. Production systems are
monitored for security events and unauthorized access.

Access controls
Employee access. Access to Telegent systems and customer data is granted based on the
principle of least privilege. Employees receive access only to the systems required for their role.
– Multi-factor authentication (MFA) is required for all privileged access to production
systems and customer data.
 – Access is reviewed periodically and revoked promptly upon role change or departure.
 – Privileged access to production infrastructure and customer communications data is limited
to authorized personnel.

Customer access. Telegent’s services are accessed primarily through our APIs. Customer API
access is authenticated using securely issued credentials. Customers are responsible for
managing and protecting their own API credentials and for controlling which of their systems
and users have access to those credentials.

Secure development
Telegent follows secure software development practices throughout the development lifecycle.
 – All production code changes go through peer review before being merged.
 – Code repositories are protected with branch controls and require approval for changes to
production branches.
 – Vulnerability scanning is performed on application dependencies and infrastructure on an
ongoing basis, and findings are tracked to remediation.
 – Development, staging, and production environments are segregated.

Vulnerability management
We continuously monitor our systems and dependencies for security vulnerabilities. Identified
issues are triaged by severity and remediated within timeframes appropriate to the risk they
present. Our infrastructure is scanned regularly, and patches are applied in line with our
internal vulnerability management policy.

We engage independent third parties to assess our security as appropriate. Findings are tracked
to remediation through our internal vulnerability management process.

Incident response
Telegent maintains a documented incident response plan covering detection, containment,
remediation, and post-incident review. Security incidents are escalated through defined
channels, and our team is on call to respond. We notify affected customers in accordance with
our contractual and legal obligations when a confirmed security incident impacts their data.
Personnel security
All Telegent employees and contractors with access to customer data:
 – Complete background checks as part of onboarding, where permitted by law.
 – Sign confidentiality agreements covering customer and proprietary information.
 – Complete security awareness training during onboarding and at least annually thereafter.

Vendor management
We evaluate the security posture of vendors and subprocessors that handle Telegent or
customer data. Vendors with access to sensitive systems or data are reviewed on an ongoing
basis. A current list of our subprocessors is available on request to security@telegent.com.

Business continuity
Telegent maintains documented business continuity and disaster recovery procedures for our
production infrastructure. We leverage our cloud provider’s resilient architecture.

Reporting a security issue
We welcome reports of potential security issues. To report a vulnerability, please submit it
through our Vulnerability Disclosure Program at telegent.com/vdp. For suspected security incidents involving Telegent services, contact security@telegent.com. We
commit to acknowledging reports promptly and working in good faith with reporters to validate
and address issues.

Last updated: May 20, 2026. Reviewed at least annually.

This page describes Telegent’s security practices as of the date above. For the most current
information or to request specific documentation under NDA, contact security@telegent.com.