Your data, your rules.
Where your clients' data is hosted, how we prepare compliance with Law 09-08, and who stays in control of the agents.
Where the data lives
Iram services run on Google Cloud in Belgium (European Union), which Morocco's CNDP lists among adequate destinations (deliberation 236-2015). The models that answer clients are Google's paid offerings, with no training on your data. Calls come in through the hotel's own line to NyamTechs' phone gateway, also in Belgium, with no third-party telephony platform. Hosting in Morocco is under study for data that requires it.
When the console's free-form assistant is switched on, it can send a question it does not recognise, masked as described below (names are not masked), and aggregated figures without names, to a free Google model (AI Studio, outside the European Union), where Google may use them. The database is backed up every day.
Compliance in Morocco
For each client we prepare the CNDP file required by Law 09-08: declaration or authorisation, transfers, processor agreement, information of the people concerned. No real data is processed before these steps. WhatsApp (Meta) is a US service; Cloudbeds, the hotel's management software, is hosted in the United States. Their transfers are handled in this file and start only after the hotel's CNDP formalities. WhatsApp, as an option, is switched on only after the CNDP has authorised it; the hotel pays Meta's fees. The online police form is closed by default: it opens only after the CNDP has given its authorisation.
Masked data
Iram never asks for a card number; a valid card number, if written, is masked before the model and never kept. In written messages, Iram also masks, before they reach the model, Moroccan CIN numbers and passports in the format of letters followed by digits, email addresses and Moroccan and French phone numbers. They are replaced with placeholders and stay on the server. Voice, voice notes and images received on WhatsApp are not masked, because they are forwarded unchanged.
What we never do
Request an ID document on WhatsApp; keep a passport photo sent through the pre-arrival page (it is read, then never kept); ask for a bank card number (if written, it is masked before the model and never kept); confirm a booking or a purchase without the client's explicit agreement; sell or transfer data.
Human control
Every agent knows when to hand over: team alert, call transfer, follow-up in a console where every action is signed by name.
Console roles
The console has four roles: director, manager, receptionist and revenue manager. Only the director manages accounts and people's rights.
Technical security
Access by account and by role, secrets kept out of the code, incoming messages authenticated (phone gateway token; WhatsApp signature if the option is on), logs without the content of the exchanges, automated tests on every change.
Your first agent, in your company.