Skip to main content
Settings → Compliance is the legal and evidence page. The header reads The blocklist, agreements, and audit trail your organization controls. Calling hours are not here — they live on Calling.

​
Do Not Call

Do Not Call list shows {count} blocked numbers (one number: {count} blocked number) and Manage list →. The card says Numbers here are blocked across every campaign. Opt-outs captured on calls propagate within 60 seconds and block in-flight retries. The list page is titled Do Not Call. With entries: {count} blocked numbers. Import, export, or add individual entries. Empty: No blocked numbers yet. Import a list or add an individual entry. View audit log sits under that line. An empty table says No do-not-call entries yet. Search is Search by phone or patient… Scope is All scopes, Organization, or Campaign (then All campaigns). Import opens Bulk Import Compliance. Add opens Add Compliance Entry. Export downloads the list and is hidden when it is empty. A row opens a sheet: Phone Number, Date Added (Added by: {name}), and Reason. Copy Phone toasts Phone number copied to clipboard. Remove asks Remove from Do Not Call List — Are you sure you want to remove this phone number from the do not call list? This action will allow calls to be made to this number again. Confirm Remove (Removing…). The toast is Phone number removed from do not call list.

​
Audit log

Audit log says Opt-ins, opt-outs, and policy edits — exportable as CSV. The explainer is A 7-year record of every compliance-relevant event, for regulators or internal review. On Business, View audit log → opens Compliance audit log. The page says {count} events. Every opt-in, opt-out, or manual edit is recorded here. You can export CSV. On Free and Team the card says The audit log is on Business and offers Continue with Business. Upgrade copy: Upgrade to export opt-ins, opt-outs, and policy edits as CSV.

​
Artifact export

Artifact export controls what leaves the workspace when someone exports, emails, or saves a file. Five switches, saved as Export policy updated:

​
HIPAA and your BAA

The section is titled HIPAA. The card is Business Associate Agreement. Until you sign your own copy, the card says You’re covered by our standard BAA automatically. Get your own signed copy anytime. It shows Current agreement version and Download agreement. You can:
  • Sign Now — opens Sign the agreement. The sheet says you are already covered by the standard agreement, and that signing is so you have your own dated copy. Maybe later closes it.
  • Send to someone else — Signer name, Signer email, then Send the link. Success is Agreement sent.
  • Upload or Replace — Upload BAA. The zone says Drag a file here, or click to browse, and Drop to upload. Formats: PDF, DOC, or DOCX · up to 25 MB. A ready file says Ready · {size}. Remove file clears it. A wrong type says Unsupported format. Use PDF, DOC, or DOCX. Over the cap: That file is over 25 MB. You must check I confirm this is a fully-executed Business Associate Agreement for our organization. This unlocks calling features that handle PHI. Then Upload. Success is BAA uploaded and Audit entry recorded. A failed save is Upload failed. If the file stored but the audit write did not: Stored, but audit write failed — see logs.
Under the buttons: Recommended, not required — sign here, or send it to whoever signs contracts, whenever you’re ready. If a link is already out: Sent and awaiting signature. You can keep using Rivvi normally in the meantime. After a signature, the card shows Signed with the date and how many prior versions are on file, plus Accepted version. A download link expires in 15 minutes. If you signed in the app and there is no file, it says Signed electronically. There’s no uploaded file to download — the signed copy is already on file. During Teach Rivvi, if Rivvi emails the agreement, the receipt says to sign it when it arrives and that patient data stays locked until it is signed. Organizations that do not handle patient information are not asked to clear that step.

​
Data and security

The section is Data & security.
  • Storage region — US East (Virginia)
  • Encryption — AES-256 at rest, TLS 1.3 in transit
Under that, Rivvi’s platform compliance says Consent and recording-disclosure rules, two-party-state handling, data-retention schedules, the sub-processor list, and SOC 2 / HIPAA reports apply to every organization on Rivvi and are published in one place, kept current. Trust Center opens trust.rivvi.ai. Request the sub-processor list under NDA emails security@rivvi.ai. These sit on the same card and do different jobs. Web research is whether the setup assistant may look up your organization on the public web — your website and provider registries, or the NPI registry for a pharmacy, or public listings for an insurance brokerage — to pre-fill the profile during setup.
  • Not authorized — the assistant will ask before it researches online.
  • Authorized — it can research online. The date is shown. Revoke turns it off.
Web search is the switch under that card: Let your AI coworker look up public web pages to answer questions during chat. Admin-only, off by default. The states are On and Off. Saving shows Web search updated. A failure is Couldn’t update web search — Try again.

​
Outreach guardrails

  • You approve every launch. Nothing dials until you approve the launch card. See Runs.
  • Opt-outs land on the Do Not Call list.
  • Calling hours are enforced from Settings → Calling.
Questions about a security review or data handling: support@rivvi.ai.

​
Next

Calling

Billing