Calls run on AWS in Sydney, in a shared account, one dedicated to you, or your own. Call records, recordings and keys are stored in the account the calls run in.
Dedicated. Control plane: Our account. Call plane: An AWS account for you alone. Your call plane gets its own AWS account in Sydney, with its own network, database, keys and model quota. No other customer's calls draw on it.
Hybrid. Control plane: Our account. Call plane: Your AWS account. The call plane runs in an AWS account you own, so call audio, transcripts, recordings and keys are stored there. We run the dashboard and releases from ours.
Your account. Control plane: Your AWS account. Call plane: Your AWS account. Both planes run in your account, and the dashboard is reachable only inside your network. Calls do not depend on our account at any point.
Choose where the call plane runs. The control plane runs with us unless you take both.
Your workspace runs on the multi-tenant platform in Sydney. Every row carries your workspace ID, and row-level security limits each read and write to it.
Suits a pilot, or a team that accepts multi-tenant isolation.
Your call plane gets its own AWS account in Sydney, with its own network, database, keys and model quota. No other customer's calls draw on it.
Suits single tenancy without running AWS yourself.
The call plane runs in an AWS account you own, so call audio, transcripts, recordings and keys are stored there. We run the dashboard and releases from ours.
Suits a security team that wants call data and keys in its own account.
Both planes run in your account, and the dashboard is reachable only inside your network. Calls do not depend on our account at any point.
Suits a policy that allows no outside control plane.
Every deployment splits the platform in two, and the call plane holds everything a call touches.
Holds agent settings and user accounts. It never stores call audio, transcripts or recordings.
Holds everything a call touches. Call content is written here and nowhere else.
The phone carrier and the speech engine sit on every call outside any AWS account.
On every call
Telnyx is a licensed Australian carrier, and call audio is anchored in Sydney. Its call control API runs in the United States and carries caller numbers and call IDs, never audio.
Deepgram processes audio and transcripts in Sydney without storing them, and keeps operational metadata and billing records in the United States. Self-hosted speech moves it inside your VPC.
Dedicated, Hybrid and Your account deployments each get their own VPC, database, keys and Bedrock quota.
The database, recordings and stored secrets are encrypted under a KMS key that can live in your AWS account. Revoke it and the data is unreadable.
Services run in private subnets. AWS services are reached over VPC endpoints, and outbound traffic passes a domain allow-list.
Your team signs in through your identity provider over SAML 2.0 or OIDC.
A release moves new calls to a second voice service once a zero-dropped-call gate passes. Rolling back returns new calls to the old version within 5 seconds.
If Sydney does not answer within 5 seconds, a handler in Melbourne answers and forwards the caller to your fallback number.
Terraform builds every deployment, never a person at a console. Our team built a private AI platform for a client on AWS in Sydney the same way.
We take your security and network teams through the design and pick the deployment.
We create the AWS account, or you create one and grant our deploy role. Bedrock access is requested in that account.
You create or grant the KMS key and connect your identity provider.
We provide or port Australian numbers, or connect a SIP trunk from your phone system.
Simulated calls test every agent before a number moves. Canary calls then test the line around the clock.
Each page holds the evidence for one part of the design.
We answer security questionnaires in writing and take your team through the architecture on a call. Send yours to hello@verticalai.com.au.
