"Is it secure?" is the right question and usually the vaguest one. Voice AI records resident audio, transcribes it, and routes it through a third-party language model. In government, that runs straight into public records law, resident trust, and procurement. Here is the short list that separates a serious vendor from a slide deck.
Where does the data live
US-only hosting should be a baseline, not an upsell. Ask where audio, transcripts, and any resident data are stored and processed, and get it in writing. If the answer includes "our provider may process data in various regions," keep asking.
Is there zero data retention with the model provider
This is the one people miss. Your vendor may have a tidy privacy policy, but the underlying AI model is run by someone else. Ask specifically: is there a contractual zero data retention agreement with the model provider, so resident audio and transcripts are not retained or used to train their models. Without it, your residents' calls could become someone else's training data.
What framework are they aligned to
For government, the right answers are the NIST Cybersecurity Framework and CISA guidance. Ask which controls they map to and whether they can show you. "We take security seriously" is not a framework.
Have they been tested by someone other than themselves
Ask for independent penetration testing and the results, specifically whether there are any open Critical, High, or Medium findings. A vendor confident in their posture will have this ready. A vendor who gets cagey is answering the question.
Can you verify without filing a request
The mature signal is a public trust center: a real-time page where your team can see controls, subprocessors, and status without a sales call. Transparency you can check beats assurances you have to trust. (Ours lives at the trust center.)
Why this is a service question, not just an IT one
Sunshine and public-records obligations do not pause because a robot answered. You need to know what is recorded, what is retained, for how long, and how it is produced if requested. The best time to get clear answers is procurement. The worst time is after a records request lands.
Vagueness on any of these is itself the finding. If you want straight answers to all of them on one call, book a demo, and ask the hard ones first.
