ANTY VIRTUAL Trust and Compliance

Trust · Security · Compliance

How Anty Virtual holds your data, and your customers’

One place for what we collect, why, how long we keep it, who can reach it, which suppliers touch it, how it is protected, and how to get it back or get rid of it. Hosted on the platform, not the marketing site, so it cannot go down with a plugin.

Last updated 27 September 2026. Written to be read, not to be survived.

What Anty Virtual is

Anty Virtual LLC builds five products for small and mid-sized businesses in the United States and Nigeria:

  • Anty Voice: an AI receptionist that answers and places phone calls for a business, books appointments and takes messages.
  • Anty Cards: NFC and QR review cards with a private feedback step before the public review link.
  • Anty Connect: AI replies on WhatsApp and Instagram that capture enquiries and book appointments.
  • Anty Food: ordering, payment, dispatch and delivery for restaurants in Lagos, with a courier fleet.
  • Anty Loyalty: points and rewards for a business’s customers.

In every one of them the business is the controller of its customers’ data and Anty Virtual is the processor, acting on the business’s instructions. The one place we are the controller ourselves is the identity check on our own couriers and field staff, and our own staff accounts.

The status, plainly

EncryptionIn transit (TLS) and at rest; identity numbers, bank accounts and connection tokens sealed a second time in the application in place
Independent security reviewFirst one 23 September 2026, findings published on the Security page; six of seven serious findings fixed, one open with its plan published
BackupsDaily, seven days of point-in-time recovery, a restore rehearsed 23 September 2026 in place
Audit logEvery sign-in with its address; every change to money, identity and settings with who and when. Reads are not logged in place
Call recording retention90 days for recordings, 365 for transcripts by default; each client sets its own in place
Sub-processors10 in use, listed with what each receives; fourteen days’ notice before a new one published
Data processing agreementReady to sign, naming you as controller and us as processor available
SOC 2Not held no
Penetration testNot yet; the September review was a code and configuration review planned
Staff two-factor sign-inSign-in is by emailed code; a second factor is not yet enforced open

On SOC 2

Anty Virtual does not hold SOC 2 today, and we will not imply otherwise. What we do instead: we had our first independent security review in September 2026 and publish its findings and their status on our Security page; data is encrypted in transit and at rest, with identity numbers, bank accounts and connection tokens sealed a second time in the application; every sign-in and every change to money, identity and settings is logged; backups are kept with seven days of point-in-time recovery and a restore has been rehearsed; every sub-processor is under a data-processing agreement, listed here, with fourteen days’ notice before a new one. We will begin a SOC 2 Type I readiness assessment when a client contract requires it, and we will say here when that starts.

The documents

Privacy PolicyWhat we collect, why, how long we keep it, and who can reach it.Data Processing AgreementThe agreement a client signs: you the controller, us the processor, our sub-processors listed.AI and Your DataClient data is never used to train any model, ours or a supplier’s, and the supplier terms that back it.Retention and DeletionHow long recordings and transcripts are kept, how you change it, and how deletion works, backups included.Where Data Is HeldThe regions, and who at Anty Virtual can reach what.Sub-ProcessorsEvery supplier that touches data, what it receives, where, and our notice commitment.SecurityEncryption, access control, audit logging, the seven serious findings and what we do about each.Your RightsAccess, rectification, erasure, portability, objection, and how to exercise them.

Who to write to