Home / Resources / WeCare / Data Governance Policies
1Ring Data Governance Policies
How 1Ring governs the data it collects, processes and accesses across cloud and on-prem deployments, and who is responsible for what.
Document Revision History
| Version | Change Description | Date |
|---|---|---|
| 1.0 | First Public Release | 15-Jan-24 |
| 2.0 | Second release | 6-Nov-26 |
© 2026 1Ring.
All Rights Reserved.
Notice
While reasonable efforts were made to ensure that the information in this document was complete and accurate at the time of printing, 1Ring can assume no liability for any errors. Changes and corrections to the information in this document may be incorporated in future releases.
Documentation disclaimer
1Ring is not responsible for any modifications, additions, or deletions to the original published version of this documentation unless such modifications, additions, or deletions were performed by 1Ring. Customer and/or End User agree to indemnify and hold harmless 1Ring, 1Ring’s agents, servants and employees against all claims, lawsuits, demands and judgments arising out of, or in connection with, subsequent modifications, additions or deletions to this documentation to the extent made by the Customer or End User.
Link disclaimer
1Ring is not responsible for the contents or reliability of any linked Web sites referenced elsewhere within this documentation, and 1Ring does not necessarily endorse the products, services, or information described or offered within them. We cannot guarantee that these links will work all of the time and we have no control over the availability of the linked pages.
Copyright
Except where expressly stated otherwise, the Product is protected by copyright and other laws respecting proprietary rights. Unauthorized reproduction, transfer, and or use can be a criminal, as well as a civil, offense under the applicable law.
1Ring support
1Ring provides a channel for you to use to report problems or to ask questions about your product. For support information, see the 1Ring Web site: https://1ring.io/contact/
1Ring is a trademark of 1Ring.
Contents
Purpose
This policy defines the governance framework for data collected, processed, and accessed by 1Ring. The objective is to protect the interests of 1Ring’s Enterprise Customers (Enterprises) and their End-users, while maintaining compliance, integrity, confidentiality, and availability of all data assets.
Scope
This policy applies to:
All data interactions between 1Ring, its Partners, Enterprise Customers (1Ring’s or Partner’s), and End-users.
All deployment models of 1Ring (on-premise and cloud).
All employees, contractors, and sub-processors of 1Ring who may access such data.
Data Privacy and Security
1Ring is built to support compliance with:
CCPA (if End-user data from California is processed)
India’s Digital Personal Data Protection Act (2023)
GDPR (if End-user data from the EU is processed)
Features include:
Customer preference logging and evidence
End-user data access and erasure support
Configurable data scopes and retention windows
Policy Review & Governance
This policy is reviewed quarterly by 1Ring’s Data Governance Council.
Customer-specific requirements may be appended via Statement of Work (SOW) or DPA.
Cloud Solution
1Ring aims to minimize data collection and processing, especially of personally identifiable or other sensitive information.
How 1Ring Works – CCaaS Architecture
Integrate using REST with your CCaaS / CPaaS provider
Mobile app integration
Dialer integration for user preference on right time to call & lead recovery (optional)
How 1Ring Works – CCaaS Call Flow
Key Data Flows and Responsibilities
Operational Flow
Enterprise Customer embeds the 1Ring SDK into its mobile application.
Before initiating a call to an End-user, the Enterprise Customer application backend sends a trigger message (which may include Personally Identifiable or Commercially Sensitive information) to the 1Ring service.
1Ring notifies the End-user via the mobile app and awaits a response.
The End-user response is relayed back to the Enterprise Customer application backend, which uses it to instruct the telephony layer to proceed or defer the outbound call.
1Ring may also receive call disposition data from the Customer, including:
Whether the call was answered (pickup: yes/no)
Call duration (length)
CRM campaign metadata
Identity-related transaction history
Roles & Responsibilities
Enterprise Customer (Data Controller): Determines purpose and means of End-user data processing. Owns CRM, campaign, and call-related data.
1Ring (Data Processor or Sub-processor): Processes data on behalf of Customer per contractual terms and deployment model.
Data Hosting and Access
Data is stored in cloud servers, currently in the AWS US East Virginia data center, which is our default location.
1Ring’s Access:
Full operational telemetry and integration data
Limited to the information sent to us in the API
Customer phone number
Optionally
Based on values filled into the “variables” provided
Access to PII, CRM metadata, call outcome data, and system logs
Encryption and Security
The service uses TLS 1.2 with ECDSA 256 (RSA 3072 equivalent) encryption for the highest security of data during transit. Data at rest is encrypted using AES-128 encryption. All connections between components are via secure channels – SSH and HTTPS.
Access Restrictions and Audit Trail
Data stored on 1Ring cloud is encrypted and under role-based access control. Only authorized service staff can access the detailed reports, evidence trail and raw data. All accesses made by our services and support staff to read sensitive data will be logged in the Audit trail system.
Data Storage
In the Cloud deployment model, 1Ring follows a data-walled garden approach where each customer’s data is stored in a separate area on the Cloud. This ensures that there is no chance of data from two or more customers being mixed up or incorrectly accessed, thereby ensuring utmost confidentiality and privacy.
On explicit request from Enterprise Customer for data deletion, all the collected data and reports will be deleted from the cloud servers.
Data Categorization and Retention
Customers can configure which fields are transmitted via the SDK or API.
The data used for delivering 1Ring functionality is categorized as below:
Raw Data: Depends on the telephony layer systems. Refer to the appropriate integration document for details.
Processed/ Intermediate Data: The data collected as tokens (or parts of) logs may include
Phone numbers
Date and Time when phone calls are made
The above data is required for end-user call pickup patterns, 1Ring-branding versus secondary branding analysis, and so on.
Report Data: On cloud, encrypted and stored in a separate bin for each customer
Retention Period
Raw Data: 30 days
Processed Data: 90 days
Reports: 1 year
Incident Management
In the event of a data breach:
Initial notification to Customer within 24 hours
Detailed incident report within 72 hours
Root cause resolution and preventive measures documented
On-Prem Solution
In an on-Prem setup, 1Ring does not have any access to Enterprise and end-user data.
How 1Ring Works – on-Prem Architecture
Integrate using SIP with your SBC
Mobile app integration
Dialer integration for user preference on right time to call & lead recovery (optional)
How 1Ring Works – Call flow
Key Data Flows and Responsibilities
Operational Flow
Enterprise Customer embeds the 1Ring SDK into its mobile application.
Before initiating a call to an End-user, the Enterprise Customer application backend sends a trigger message (which may include Personally Identifiable or Commercially Sensitive information) to the 1Ring server.
1Ring notifies the End-user via the mobile app and awaits a response.
The End-user response is relayed back to the Enterprise Customer server, which uses it to instruct the telephony layer to proceed or defer the outbound call.
1Ring may also receive call disposition data from the Customer, including:
Whether the call was answered (pickup: yes/no)
Call duration (length)
Identity-related transaction history
Roles & Responsibilities
Enterprise Customer (Data Controller): Determines purpose and means of End-user data processing. Owns CRM, campaign, and call-related data.
1Ring has no role in this, since 1Ring has no access to the on-prem server and its data.
Data Hosting and Access
Data is stored in the 1Ring on-prem server.
1Ring’s Access: Limited to:
Deployment support
SDK version updates
Remote debugging (only with explicit Customer authorization)
Encryption and Security
The service uses TLS 1.2 with ECDSA 256 (RSA 3072 equivalent) encryption for the highest security of data during transit. Data at rest is encrypted using AES-128 encryption. All connections between components are via secure channels – SSH and HTTPS.
Access Restrictions and Audit Trail
Data stored on 1Ring server is encrypted and under role-based access control. Only authorized service staff from Enterprise Customer can access the detailed reports, evidence trail and raw data. All accesses made by Enterprise Customer services and support staff to read sensitive data will be logged in the Audit trail system.
Data Storage
In the On-prem deployment model, data is stored locally on the on-premise servers.
Data Categorization and Retention
Customers can configure which fields are transmitted via the SDK or API.
The data used for delivering 1Ring functionality is categorized as below:
Raw Data: Depends on the telephony layer systems. Refer to the appropriate integration document for details.
Processed/ Intermediate Data: The data collected as tokens (or parts of) logs may include
Phone numbers
Date and Time when phone calls are made
The above data is required for end-user call pickup patterns, 1Ring-branding versus secondary branding analysis, and so on.
Report Data: In the On-prem deployment model, report data is stored locally on the on-premise servers.
Retention Period
Raw Data: 30 days
Processed Data: 90 days
Reports: 1 year
Incident Management
In the event of a data breach, since the servers are on-prem, it is Customer’s responsibility to handle the issue and fallout. 1Ring will cooperate fully in investigating the nature of the data breach, treating it as an L1 support incident.