Governance, Privacy & Voice

Data classes, masking, retention, audit and how voice agents write into the same governed memory.

Data classes

Every collection in a module belongs to one of three classes. Administrators set the class in Settings; it decides what Enterprise Mind may keep and who sees it in answers.

Choosing a class

Start with Internal for anything commercial and Public for operational records such as tasks and bookings.
Leave anything about a person's pay, health or identity as Sensitive.
When unsure, choose the stricter class; you can relax it later and the change is audited.

app.totalapp.app/enterprise-mind/settings

Data classesadmin only

PUBLICReservations, tasks

Shared with Enterprise Mind

INTERNALPricing, supplier terms

Shared, masked in answers to other roles

SENSITIVESalary, health, ID numbers

Never leaves the module unless you opt in

Retention and masking

Keep for

180 days

PII maskinganna.k•••@•••.com · TR•• •••• 4821

Audit trail

09:12 recall · M. Reed · hospitality
09:13 suggest · BrainAgent · tr_77
09:14 approve · M. Reed · T-118

Class	Examples	Behaviour
Public	Reservations, tasks, work orders	Shared with Enterprise Mind and visible to anyone who can open the module.
Internal	Pricing, supplier terms, margins	Shared, but masked in answers shown to roles without access.
Sensitive	Salary, health data, identity numbers	Off by default. Never leaves the module unless an administrator turns it on.

Who can see what

Enterprise Mind never widens access. A person sees an answer only if they could already open the underlying record.

Data class	Module staff	Approvers	Administrators	Other roles
Public	Full	Full	Full	Full if they can open the module
Internal	Full for their module	Full	Full	Masked
Sensitive	Only if the role already has it	Only if the role already has it	Full, audited	Hidden

Masking, retention and audit

Masking. Personal information such as e-mail addresses, phone numbers, card and identity numbers is masked before text reaches any AI model.
Retention. Set how long entries and call transcripts are kept, per data class. When the period ends they are removed.
Audit trail. Every recall, suggestion and approval is logged with who, when and which module, and the log can be exported.
Tenant isolation. Memory belongs to your tenant and is never mixed with another tenant's.

Choosing the AI engine

Enterprise Mind uses the AI engine selected in Settings. Choose a cloud model for convenience or a local model when data must stay on your own machines. Memory, policy and approvals work the same either way.

Switch off per module

Turning Enterprise Mind off for a module stops new recording at once. Existing entries stay until their retention period ends.

The audit trail in detail

The audit trail is a separate, read-only record of what Enterprise Mind did and who asked it to.

Entry	What is logged
Recall	Who searched, in which module, for what kind of case, and which results were shown.
Suggestion	What was suggested, its confidence, the evidence list and the policy check result.
Approval	Who approved, edited or rejected, with the reason text and the time.
Action	What ran, under which level, which limits it passed and the result.
Settings change	Who changed a data class, retention period or autonomy level, with old and new values.

The trail can be exported as a spreadsheet file by module administrators for reviews and audits.

Personal data and requests

Enterprise Mind helps you meet data-protection duties; it does not replace your own policies.

Request	How it is handled
Access: "What do you hold about this person?"	Search the ledger and call summaries by person or customer record and export the matching entries.
Erasure	An administrator removes the entries linked to the person. The deletion itself is written to the audit trail without the personal details.
Correction	A correction is added as a new entry that points to the old one; the old entry is marked superseded.
Stop learning from a person	Switch that person's decisions to role-level recording.

Voice and channels

Voice agents answer calls in the caller's language, create or update the record, and write what they learned into the same memory your team uses.

When voice is a good fit

High-volume, repetitive calls: bookings, order status, appointment changes.
Callers in several languages, or calls outside office hours.
Cases where the history of the caller changes the answer.

app.totalapp.app/hospitality

Booking callended 02:41

Guest · EN

Hi, I booked last spring. Same quiet room please?

Voice agent · EN

Welcome back. Room 306 faces the garden and is free for 2 nights. Shall I book it?

Guest · TR

Evet lütfen, ve geç varacağız.

Extracted after the call

Booking created Preference remembered Late arrival task

memory.write → guest:G-884 · “prefers quiet, garden-facing; late arrival”

After the call	What is written
Record	A booking, task or case is created or updated in the right module.
Preferences	Things the caller asked for are kept on their record, for example a quiet room.
Follow-ups	Tasks such as a late arrival are created for staff.
Summary	A short summary and the language used go into the ledger.

The agent speaks English, Spanish, Russian, Turkish, Arabic, French, German, Portuguese and Italian, and can switch language during a call.
Next time the same guest calls, the agent already knows the last stay and stated preferences.
Booking, payment and clinical steps stay behind your approval rules. A call never skips them.
Transcript retention follows the data class you set; sensitive content is off by default.

Healthcare

In Healthcare, voice agents may collect information and create follow-up tasks but never confirm clinical actions. A staff member does.

How a call flows through the system

Call answered

→

Caller recognised

→

Record found or created

→

Allowed actions only

→

Summary written

→

Follow-ups created

Moment	What the agent may do	What stays with a person
Start of the call	Greet in the caller's language, look up the caller's record and past preferences.	Identity checks that your policy requires
During the call	Read availability, quote options, create a booking from the action catalog.	Payments, refunds and anything above your limits
End of the call	Write the summary and preferences, create follow-up tasks.	Complaints and exceptions, handed over with a summary

Handing over

When the agent cannot or should not continue, it passes the call to a person together with a written summary, so the caller does not repeat themselves.

Administrator checklist

Every collection has a data class, and sensitive ones are reviewed by the data owner.
Retention periods are set per class and match your company policy.
Masking is on, and a test record with an e-mail address and a phone number shows masked values in answers.
The AI engine in Settings is the one your data rules allow.
Approver roles are assigned and each has a named deputy.
The audit trail has been exported once to confirm who can read it.

FAQ

Does Enterprise Mind keep data about individual employees?

It records business decisions, not clicks or screen time. Administrators can choose to record roles instead of people.

Can sensitive collections be included later?

Yes, an administrator can switch a sensitive collection on. Masking still applies and the change is written to the audit trail.

Who can export the audit trail?

Administrators of the module.

Related pages: Overview · Memory · Autonomy & Approvals