ValPhone Compliance Documentation

This document highlights some of the controls in place that Valstorm LLC uses in its software as a service product, ValPhone. As a customer of Valstorm LLC, and a user of ValPhone, your company must maintain a shared compliance model as a user of any Valstorm LLC software.

ValPhone offers calling and texting services, so it must comply with the rules and organizations such as the FTC, FCC, TCPA and TCR’s A2P 10DLC Compliance. This means that ValPhone maintains its portion of compliance responsibility as a Service Provider, which many of the laws and organizations specify in their documentation and regulations.

You, the customer/user, must maintain your portion as well. During conversations with Valstorm LLC, Valstorm may notice behaviors that require an Enterprise Plan which you will be informed of. Valstorm recommends that you leverage your own legal counsel. Suggestions from Valstorm LLC are not legal counsel.

Valstorm LLC uses Twilio for text messaging and calling via ValPhone. Valstorm LLC can manage your Twilio Account, or you can provide Valstorm LLC access to your Twilio Account. Valstorm LLC prefers you own your account for the highest level of compliance, security and control over your own Twilio bill. ValPhone makes the Twilio API a useful and available service for adding sales, marketing and service based communication activities to your Valstorm CRM, AKA ValRM, or to a Salesforce System via Valstorm LLC’s Salesforce Integration Service.

A2P 10DLC (Application to Person 10 Digit Long Code)

A2P 10DLC (Application to Person 10 digit long code) is the standard that United States telecom carriers have put in place to ensure that SMS traffic to US end-users through long code phone numbers is verified and consensual.

To send text messages with ValPhone, you will need to register your campaign with The Campaign Registry (TCR). The appropriate registration depends on if you use a local number, a 8XX number or a short code number. Valstorm LLC can help you submit the paperwork and manage your Twilio account.

Twilio provides some excellent documentation on this content: https://www.twilio.com/docs/messaging/compliance/a2p-10dlc

TCPA

The Telephone Consumer Protection Act (TCPA) is the primary federal law regulating telemarketing. You can find a detailed summary of the rules on the FCC's website.

Valstorm LLC and its Product ValPhone acts as a Service Provider. Please note some rights that Valstorm LLC reserves in accordance with maintaining a compliant solution.

  • Telephone service providers can offer robocall blocking to consumers.
  • Telemarketers may not use automated dialing to call wireless phone and leave pre-recorded telemarketing messages without consent.
  • Consumers may revoke consent to receive calls or SMS messages in any 'reasonable' way, at any time.
  • Callers must cease calling any reassigned phone numbers (wired and wireless).
  • Consent 'survives' when a person ports their landline phone number to a wireless number.
  • Some 'urgent circumstances' still allow a company to call or send SMSes to wireless phones without prior consent, such as alerts about potential fraud or reminders of urgent medication refills. However, the company instigating such communications must offer consumers an 'opt-out' option.

SMS/MMS Messaging Opt Outs

ValPhone automatically manages opt-outs for text messaging. If a person replies with "STOP", "UNSUBSCRIBE", "OPT OUT" to any phone number in your ValPhone system, they will be automatically opted out of receiving any further text messages from any phone number in your ValPhone system. This is a requirement of the TCPA. You can add other keywords to manage opt-outs in your ValPhone settings, and edit the automatic output message that the client receives upon opting out.

SMS/MMS Messaging Opt Ins

ValPhone automatically manages opt-ins for text messaging. If a person replies with "START", "SUBSCRIBE", "OPT IN" to any phone number in your ValPhone system, they will be automatically opted in to receiving further text messages from any phone number in your ValPhone system. You can add other keywords to manage opt-ins in your ValPhone settings, and edit the automatic output message that the client receives upon opting in.

Opt-ins can be managed programmatically via the Valstorm API, or manually in the ValPhone web application. Some common ways to get opt-ins include:

  • A web form on your website that includes a checkbox for opting in to text messages.
  • A verbal opt-in during a phone call, which you should document in your CRM notes or call recording.
  • An IVR system that collects opt-ins during a call.
  • A registration process that includes an opt-in for text messages.

Managing Opt-Ins via the Valstorm API

The following APIs are available to manage opt-ins:

  • A POST method call to the create records API. - Create Record Api

    • Example url: https://api.valstorm.com/v1/object/contact method: POST 
      {
    "first_name": "John",
    "last_name": "Doe",
    "phone": "+1234567890",
    "sms_opt_in": true,
    "email_opt_in": true,
    "do_not_call": false,
}

  • A PATCH method call to the update records API. - Update Record Api

    • Example url: https://api.valstorm.com/v1/object/contact method: PATCH 
      {
    "id": "contact_id",
    "sms_opt_in": true,
    "email_opt_in": true,
    "do_not_call": false
}

  • sms_opt_in - Boolean - Indicates if the contact has opted in to receive SMS messages.

  • email_opt_in - Boolean - Indicates if the contact has opted in to receive email messages.

  • do_not_call - Boolean - Indicates if the contact has opted out of receiving phone calls.

You can learn more about the contact object schema by calling the Get Object Schema API - Get Object Schema Api

  • Example url: https://api.valstorm.com/v1/schema/contact method: GET

Other Compliance Considerations

Call Recording

ValPhone offers call recording as a feature. If you enable call recording, you must comply with federal and state laws regarding call recording. In the United States, federal law requires one-party consent, meaning that at least one party on the call must consent to the recording. However, some states require all-party consent. It is your responsibility to ensure compliance with these laws.

Adding a verbal notification at the beginning of the call is a common practice to inform all parties that the call may be recorded, and this can be automated using ValPhone's features. At anytime, you can disable call recording in your ValPhone settings. Call recording is disabled by default.

To access recordings, you must have the appropriate permissions in ValPhone and be logged into your account. This ensures that only authorized users can access sensitive information.

For additional HIPAA compliance, Valstorm LLC offers an Enterprise Plan that includes additional features and controls to help you comply with HIPAA regulations. Please contact Valstorm LLC for more information.

AI Call Transcription

ValPhone offers AI Transcription to help you with your communication needs. However, it is your responsibility to ensure that you use these features in compliance with all applicable laws and regulations. AI Transcription are disabled by default. You must enable them in your ValPhone settings.

ValPhone offers AI Transcription through third party services such as Twilio, Google Gemini, Open AI, and others. You can select the appropriate service, which allows you to choose the service that best meets your needs and compliance requirements. Given that each service has a paid plan that meets SOC 2, HIPAA, and other compliance requirements, you must select the appropriate plan that meets your needs. Twilio is your fastest path to compliance, but you can later switch to another service if needed.

Frequently Asked Questions (FAQ)

Q: Are there any guarantees of compliance? A: Valstorm LLC guarantees its portion of compliance as a Service Provider. You are responsible for your portion as a user of ValPhone. Valstorm LLC recommends you leverage your own legal counsel to ensure your operations are fully compliant.

Q: What is the shared compliance model? A: The shared compliance model means that both Valstorm LLC and you, the customer/user, share responsibility for compliance. Valstorm LLC maintains its portion as a Service Provider, while you must ensure your own business practices adhere to relevant laws and regulations in the areas you operate.

Q: Is using ValPhone automatically TCPA compliant? A: No. ValPhone is a tool designed to help with compliance, but you are ultimately responsible for how you use it. Under the shared compliance model, you must ensure your own business practices—like getting proper consent before calling or texting—adhere to the TCPA.

Q: Do I need to hire my own lawyer? A: Yes, this is strongly recommended. The guidance provided by Valstorm LLC is for informational purposes only and does not constitute legal advice. You should consult with your own legal counsel to ensure your operations are fully compliant.

Q: What is A2P 10DLC and do I have to register? A: A2P 10DLC is the industry standard for sending business texts from local 10-digit phone numbers to consumers in the US. Yes, you must register your texting campaigns with The Campaign Registry (TCR) to ensure deliverability and compliance. Valstorm can assist you with the registration process.

Q: Why do you recommend I own my own Twilio account? A: Owning your own Twilio account provides you with the highest level of security, control, and transparency. You have direct oversight of your usage, billing, and compliance settings.

Q: What happens if I call a number that has been reassigned to a new person? A: Under the TCPA, you are responsible for ceasing calls to any number once it has been reassigned. You must implement your own procedures to regularly check and update your contact lists to remain compliant.