dohosGet started
PLATE Nº 075

Compliance

Dohos's position on every framework relevant to a phone-answering voice product — where each applies, where it doesn't, and where a certification hasn't been obtained.

PLATE Nº 075 · COMPLIANCE
TARGET-STATE DRAFT — NOT APPROVED OR EFFECTIVE
FRAMED · INTRODUCTION

A vendor-risk review runs through the same handful of frameworks almost every time: data protection law, payment-card handling, telephone consent law, state recording law, accessibility standards, and — for a voice product specifically — the newer wave of AI-disclosure statutes. This wing states Dohos's position on each, one at a time, rather than a single badge or a compliance score.

Three answers are possible for any framework, and this wing never blurs them together: a framework applies today and Dohos's policy is built to meet it; a framework does not currently apply, stated plainly with the reason; or a framework calls for a third-party certification Dohos has not obtained, in which case that fact is stated directly rather than dressed up as a target date.

NOTE — SOC 2No SOC 2 audit has been performed, so there is no report, scope, period, or set of exceptions to publish — a compliance page describing a certification that hasn't happened is worse than no page, so this site does not carry one. Security posture and controls are described directly, without a certification claim attached to them.
NOTE — HIPAADohos does not process Protected Health Information and is not a HIPAA Covered Entity or Business Associate. Healthcare, clinical, and insurance functions are disabled categorically, not gated behind a future capability — an allergy or dietary instruction captured for an order is handled as ordinary order data, not as a health record.

This wing is not a certification, an audit opinion, or a legal compliance determination — those require counsel and, where a framework calls for one, an independent auditor. The positions here reflect internal policy and product design as currently written, not a verified, tested, or activated operating state.

FRAMEWORK BY FRAMEWORK

Data protection sits together — GDPR and CCPA answer the same underlying question under two vocabularies. Payment scope is the shortest honest answer on the register: a card number spoken during a call never reaches a system Dohos controls. Calls and messages are where a voice product's exposure concentrates — the TCPA governs the call itself; state recording law governs whether it may be captured. And accessibility and AI disclosure each state an engineering practice honestly, without a conformance report or statute survey that doesn't exist yet.

PLATE Nº 076

Accessibility

WCAG posture for console, station, and site.

OPEN →PLATE Nº 077

AI disclosure

How callers are told they're talking to an AI.

OPEN →PLATE Nº 078

CCPA

California privacy rights and how we honor them.

OPEN →PLATE Nº 079

GDPR

EU data protection posture.

OPEN →PLATE Nº 080

PCI

Cardholder data scope. DRAFT — pending the payments gate.

OPEN →PLATE Nº 081

Call recording by state

One- and two-party consent handling.

OPEN →PLATE Nº 082

TCPA

Outbound calling rules and consent.

OPEN →
WHO THIS WING IS FOR
THE VENDOR-RISK REVIEWERRunning a framework checklist — each page states position, mechanism, and the honest gap.
LEGAL COUNSELRole vocabulary per statute — controller/processor, business/service provider — mapped once, not re-argued.
THE OWNERWhat the phone line's regulatory surface means for the restaurant that owns the number.
THE ACCESSIBILITY REVIEWERThe WCAG 2.2 AA target and a plain statement that no VPAT exists yet.

Every source policy behind this wing reviews itself at least annually and on any material change to law, product, or provider — the same cadence that governs the rest of Dohos's legal library. These pages update on the same trigger, not on a fixed publishing calendar. The signable contract behind the role language here is the data processing agreement; the procurement bundle is at the vendor packet; and service limitations carries the standing rule against claiming a certification status without current evidence — the rule this entire wing is written to honor.