Aircall DPA: what it covers, and how JustCall, PhoneBurner and DialSheet compare
A Data Processing Agreement is the contract that says what a vendor may do with your customers’ data and what it promises to keep it safe. Not every power dialer publishes one, and the ones that do differ a lot in how far you have to go to get it. Read directly from each vendor’s own site September 14, 2026.
What Aircall's DPA actually covers
Aircall’s DPA (last updated January 15, 2025, with six prior versions linked back to July 2021) is an addendum to its Master Subscription Agreement. Read in full today, the parts that matter to a buyer checking compliance:
| Item | What the DPA says |
|---|---|
| International transfers | EU Standard Contractual Clauses (Module 2 or 3, depending on your role), plus the EU-U.S. and Swiss-U.S. Data Privacy Framework for transfers to Aircall.io, Inc. in the US. |
| UK transfers | The UK International Data Transfer Addendum, appended to the same SCCs. |
| Security certification | At least an annual independent audit "in accordance with SOC 2, Type II standards or its equivalent," at Aircall’s expense. |
| Encryption | TLS 1.2+ for data in transit; AES-256 at rest, via subprocessor AWS. |
| Breach notice | Within 24 hours of detection where European data protection law applies. |
| Subprocessors | A published list on Aircall’s site; 10 business days’ notice before a change, with a right to object. |
| HIPAA | A separate Business Associate Agreement (BAA), executed alongside the DPA, if you send Protected Health Information. |
| Data return and deletion | 30 days to export after termination, then Aircall deletes what it holds on your behalf. |
| Audit rights | Once every 12 months, 30 days’ notice, at each party’s own cost. |
Aircall vs JustCall vs PhoneBurner vs DialSheet, on paper
| Aircall | JustCall | PhoneBurner | DialSheet | |
|---|---|---|---|---|
| Published DPA you can read without a sales call | Yes, aircall.io/dpa | No — sign one on request via Trust Center | Not published | Not published |
| Security certification stated | SOC 2 Type II (annual) | SOC 2 Type 2 + ISO 27001:2022 | SOC 2 Type II controls, per its privacy policy | None published |
| GDPR / UK GDPR terms | Yes — SCCs, DPF, UK Addendum | On request | Not mentioned; scoped to US/Canada | Not published |
| HIPAA BAA available | Yes, on request alongside the DPA | Yes, on request | Only with a signed BAA; PHI otherwise out of scope | Not offered |
| Published subprocessor list | Yes | Not checked | Not checked | Named in the privacy policy: Supabase, Vercel, Twilio, Stripe, Google |
| Starting price | ~$30–50/user/mo, 3-licence minimum | ~$29–89/user/mo, 2-licence minimum | ~$140–183/user/mo | $0, no seat minimum, then $29/month, then $19 per seat |
Read from each vendor's own site September 14, 2026: aircall.io/dpa, justcall.io/security-and-compliance, phoneburner.com/privacy, and DialSheet's own /privacy and /terms. Not legal advice — confirm current terms directly before buying.
Where DialSheet is behind, plainly
We build DialSheet, so this section gets the same honesty as the rest of the site. DialSheet runs on your own Twilio account: your leads’ phone calls, recordings and PSTN routing are largely processed inside your Twilio account, under Twilio’s own DPA, SOC 2 and ISO 27001 certifications and its own HIPAA BAA — a different architecture from a bundled dialer that holds all of that itself. That narrows what DialSheet processes to lead records, call metadata, notes and account data, stored on Supabase and served by Vercel, both of which publish their own SOC 2 Type II reports.
That architecture is not a substitute for a signed DPA, and DialSheet does not have a self-serve one the way Aircall does, or an on-request process the way JustCall does. If your business requires an executed Data Processing Agreement on file before it can buy any software — a common gate at larger companies and regulated UK or EU practices — DialSheet is not ready to clear that gate today. Email abhi@paperkites.co if you need one; it is a real request, not a formality, and we do not yet have a standard turnaround to promise.
- No published Data Processing Agreement.
- No SOC 2, ISO 27001 or other third-party security certification of our own.
- No HIPAA Business Associate Agreement offered.
- No dedicated Trust Center or subprocessor-change notice process.
Which should you buy, on this alone?
Your procurement team requires a signed DPA before any purchase
Aircall, since you can read and sign the DPA yourself with no sales call, or JustCall if you are comfortable requesting one through its Trust Center. Neither DialSheet nor a plain Twilio integration replaces that paperwork today.
You are a US or Canada business with no GDPR or HIPAA requirement
Any of the four will work on paper, though PhoneBurner is the only one that states its scope this narrowly in writing. DialSheet is $0 to start with no seat minimum if the deciding factor is cost rather than a compliance document.
You need a HIPAA BAA for call recordings or transcripts
Aircall or JustCall, both of which describe a BAA process in writing. DialSheet does not offer one; do not send Protected Health Information through it.
You are an EU or UK team and just want to confirm SCCs exist
Aircall. Its DPA names the EU Standard Contractual Clauses and the UK International Data Transfer Addendum directly, with the modules and options already selected — the fastest of the four to actually verify.
Common questions
Does Aircall have a DPA?
Yes. Aircall publishes a self-serve Data Processing Agreement at aircall.io/dpa, last updated January 15, 2025, with a version history back to 2021. It covers GDPR, UK GDPR, the Swiss FADP and US state privacy laws, names Aircall as the data processor, incorporates the EU Standard Contractual Clauses for international transfers, and commits to at least an annual SOC 2 Type II audit, AES-256 encryption at rest and TLS 1.2+ in transit. No sales call is required to read it.
Does Aircall sign a Business Associate Agreement (BAA) for HIPAA?
Aircall's DPA addresses HIPAA directly: if a customer qualifies as a Covered Entity or Business Associate and will send Protected Health Information through Aircall, the DPA says the customer must separately execute a BAA, which then takes precedence over the DPA for that data. Confirm current BAA availability and scope with Aircall's sales or support team before sending any PHI through the platform.
Does JustCall have a DPA?
JustCall does not publish a standing DPA document on its site. Its security and compliance page says customers "can sign a Data Processing Addendum that governs our processing of your data" by contacting JustCall directly. JustCall holds SOC 2 Type 2 compliance and ISO 27001:2022 certification, and says it will sign a customer's own BAA template for HIPAA on request — details live behind its Trust Center, not a public URL.
Does PhoneBurner have a DPA or GDPR terms?
PhoneBurner's privacy policy (effective February 3, 2026) states the platform "is intended for use in the United States and Canada only," references SOC 2 Type II controls for security, and covers US state privacy laws (CPRA, Colorado, Connecticut, Virginia) and Canada's PIPEDA. It does not mention GDPR, the UK GDPR, EU Standard Contractual Clauses or a Data Processing Agreement anywhere. A UK or EU business with a GDPR requirement will not find those terms published, and should ask PhoneBurner directly before buying.
Does DialSheet have a DPA?
Not yet, published or on file. DialSheet's privacy policy is a short, plain-English page that names Supabase, Vercel, Twilio, Stripe and Google as processors and states we act as a processor for the lead data you upload, but there is no formal GDPR Article 28 document to sign. Most of the call audio and PSTN routing for a BYOC customer happens inside their own Twilio account, under Twilio's own DPA, which narrows what DialSheet itself holds to leads, call metadata and notes — but it is not a substitute for an executed DPA. If your business needs one on file before it can buy software, email abhi@paperkites.co; today, DialSheet is not yet set up to sign one at the speed Aircall or JustCall can.
What subprocessors does Aircall use?
Aircall's DPA authorizes it to engage the subprocessors listed on its own website, which it can add to or replace with 10 business days' notice to the customer's admin users; a customer can object within that window. The current list lives on Aircall's site rather than inside the DPA text itself, so check it directly for the named companies and their locations before you sign.
This is general information, not legal advice, and DPA terms change. Read the current version on each vendor’s own site and confirm with your own counsel before you sign anything. DialSheet is our product; every other vendor’s terms are quoted from its own published pages as read on September 14, 2026.