01Questions
Do you have a SOC 2 report?
No. No SOC 2 or other independent audit has been performed, so there is no report, scope, period, or exceptions list to share. The security whitepaper describes Dohos's actual controls directly, without a certification claim attached to them.
Have you had a penetration test?
No. No independent penetration test of any Dohos system has been performed. See the security whitepaper for the controls and testing practices that exist instead of a test report.
Do you carry cyber liability or commercial insurance?
No commercial insurance policy is currently bound. There is no carrier, policy number, coverage limit, or certificate to publish. This is not published elsewhere on the site as in place, and it should not be assumed.
What's your uptime SLA — what percentage do you commit to?
None is approved yet. The measurement method is fully defined — how a percentage would be calculated, how an issue would be prioritized, what an exception looks like — but no target percentage, response time, or service-credit formula has cleared internal review. See the availability commitment for the method and the exact list of what's still open.
Is card payment data PCI-scoped on your side?
By design, no card number, security code, or expiration date is meant to reach a system Dohos controls at any point in a call — the system is built to detect and interrupt spoken card data and redirect to a secure, provider-hosted step instead. See the PCI position for the mechanism, not just the conclusion.
Are you GDPR compliant?
GDPR doesn't currently apply — the target service and jurisdiction allowlist are U.S.-focused, and no EU, UK, or Swiss transfer mechanism is incorporated into the data processing agreement. See the GDPR position for why, specifically.
Do you sell or share personal data, or use it for advertising?
No. Dohos's internal privacy policy prohibits selling personal data, sharing it for cross-context behavioral advertising, and building advertising profiles — categorically, not state-gated or feature-gated. See the privacy wing for the full list of things that stay off by default.
Who are your subprocessors?
The approved subprocessor register is currently empty — zero rows. That states only that no candidate vendor has cleared the diligence process for public listing yet; it doesn't mean no infrastructure is used. See subprocessors for exactly what that empty register does and doesn't mean, and the named infrastructure disclosed separately.
Is every call recorded?
Not by default. Raw audio recording is a separate, off-by-default capability a restaurant enables per location, with the caller told at the start of the call. A text transcript of the call is a different, standard part of the service — see the next question. Detail at state recording law.
Is a transcript of the call kept?
Yes. A text transcript of every completed call is generated and retained as standard service delivery — not an opt-in add-on — for a defined period, access limited to restaurant staff whose role needs it. This is a separate switch from audio recording, described above. See retention for how long and who can see it.
How is internal access to a restaurant's data controlled?
Through four defined roles — owner, manager, staff, and a deliberately narrow Dohos administrator role — granted explicitly for what a role's job requires, not inherited by default, and removed the day it's no longer needed. See access control for the full model, including how support access to a restaurant's account is scoped and logged.
What happens if your platform goes down?
An inbound call is never met with silence: if the voice platform can't take it, the call is forwarded to a number the restaurant already set — its own line, a manager's phone. That's product behavior confirmed by the build, separate from the still-unapproved availability percentage. See reliability and business continuity.
Do you train AI models on our calls or menu data?
No — a flat, unqualified no for every restaurant. A menu configures per-account speech-recognition hints for that restaurant's own calls only; it does not retrain any model, and the improvement never transfers to another restaurant. See AI training.
Is your product WCAG- or ADA-certified?
No VPAT or Accessibility Conformance Report exists yet. WCAG 2.2 Level AA is the engineering and design target across the site, console, and voice channel, and automated scanning alone is never treated as sufficient to claim conformance. See accessibility conformance.