Voximplant

What is Voximplant?

Voximplant is a cloud communications platform operated by Zingaya Inc. that provides programmable voice, video, and messaging APIs for embedding real-time communication into websites and mobile applications. It is used to build features such as click-to-call widgets, video consultation rooms, in-app messaging, and automated IVR systems. Voximplant is headquartered in the United States with significant infrastructure in Russia, which raises particular concerns for European data protection compliance given that Russia has no EU adequacy decision.

What data does Voximplant collect?

Voximplant processes call metadata including caller and recipient identifiers, call timestamps, duration, and connection quality metrics. If call recording is enabled, the full audio or video content of conversations is stored on Voximplant servers. For WebRTC-based browser calls, the platform accesses the user's microphone and camera with explicit browser permission. IP addresses, browser information, and session identifiers are also collected. The sensitivity of this data is high, as communications content may include confidential personal, medical, financial, or legal information.

GDPR and ePrivacy implications

Voximplant's GDPR compliance is complex. The ePrivacy Directive's confidentiality of communications provisions apply to calls handled through Voximplant, requiring that participants are informed before any recording or monitoring. Under GDPR, communications metadata and content are highly sensitive personal data. The potential transfer of this data to Russia, which has no adequacy decision and whose surveillance laws are incompatible with EU privacy standards, creates a particularly high risk that organisations must address before deploying Voximplant for European users.

Consent requirements

Consent is required before the Voximplant SDK loads on a website. For call recording, explicit consent from all participants is required under both GDPR and the ePrivacy Directive's communications confidentiality rules. The consent mechanism for call recording must be active (not implied) and must clearly state that the call will be recorded, who will have access to the recording, how long it will be retained, and where it will be stored. Participants must be able to withdraw consent, which must result in the immediate cessation of recording.

Data transfers outside the EU

Voximplant operates infrastructure in Russia and the United States, neither of which has an EU adequacy decision for the purposes of GDPR Chapter V transfers in this context. For US transfers, Standard Contractual Clauses apply. For Russia, no adequate transfer mechanism exists under GDPR, making any transfer of EU personal data to Russian infrastructure potentially unlawful. Organisations deploying Voximplant must specifically configure EU server routing and verify that no data is routed through Russian infrastructure. This should be confirmed with Voximplant in writing and documented in the DPA.

Practical compliance steps

To deploy Voximplant compliantly in the EU: request and confirm EU-only server routing in writing from Voximplant; block the SDK until consent is obtained; obtain explicit consent before any call recording; update your privacy policy to describe call data processing, recording policies, and applicable transfer mechanisms; sign a DPA with Voximplant that explicitly restricts processing to EU infrastructure; conduct a DPIA given the sensitive nature of communications data; and document all processing and transfers in your RoPA. Consider EU-based communication platforms if the Russian infrastructure concern cannot be fully mitigated.