Sovereign CCaaS in France: securing customer relationships without compromising on innovation

A CCaaS environment can process a considerable volume of data. Customer interactions may contain personal details, contractual information, complaints, details of personal circumstances, communications of high commercial value, etc. 

The sovereignty of a CCaaS platform is not limited to the data centre’s address. It encompasses several complementary dimensions: 

• the location of data, including production, backup, logging and support data; 

• access control, particularly for administrators, maintenance teams and subcontractors; 

• control over the subcontracting chain, from the software vendor to infrastructure providers; 

• protection against extraterritorial access requests; 

• the ability to revert, i.e. the capacity to recover data, settings and relevant historical records in the event of a change of solution; 

• business continuity, which is essential for maintaining customer relationships even in the event of a major incident. 

Data sovereignty does not mean abandoning the cloud. It involves selecting a cloud model suited to the sensitivity of the data and the level of control expected by the organisation. 

For a French organisation, evaluating a CCaaS solution involves examining the security of the hosting and data governance beyond mere commercial promises. The provider must be able to provide documented, verifiable and, where necessary, contractually agreed evidence. 

Key considerations include the hosting of production data, backups and security logs; encryption at rest and in transit; the separation of customer environments; strong authentication; access management based on the principle of least privilege; logging of administrative operations; backup policies; restoration tests; vulnerability management; incident response; support intervention procedures; and data return and deletion procedures. 

In this context, Magellan CX Suite benefits from a SecNumCloud-certified hosting infrastructure. This approach provides a solution for organisations seeking a modern customer relationship management platform, whilst enhancing security, resilience and control over data. 

Data protection is not merely an IT, legal or compliance issue. It plays a direct part in the trust a customer places in an organisation. 

When a customer contacts customer services, they may share personal, confidential or financial information, or details relating to a sensitive situation. The company’s ability to protect this exchange therefore plays a part in the perceived quality of the customer’s experience. 

Conversely, a cybersecurity incident, unauthorised access to conversations or a lack of transparency regarding data processing can cause lasting damage to a brand’s reputation. A secure and sovereign CCaaS solution thus enables the development of omnichannel customer journeys, monitoring functions, quality analytics and automation, without compromising the confidentiality of interactions. 

Artificial intelligence is transforming the way contact centres operate. It can assist agents in real time, automatically summarise conversations, categorise the reasons for contact, facilitate routing, analyse quality, speed up access to knowledge, or help produce post-interaction reports. 

These applications can improve operational efficiency and the agent experience. However, they also introduce specific risks: the processing of personal data, errors or generative hallucinations, bias, a lack of explainability, the disclosure of confidential information, uncontrolled reuse of data, or automated decisions that may affect customers and staff. 

Trustworthy AI in a CCaaS environment must therefore be based on several principles: 

• clearly defining the purposes of each use case; 

• limiting the data used to what is strictly necessary; 

• ensuring human oversight for sensitive recommendations and decisions; 

• ensuring the traceability of processing and the quality of results; 

• protecting data flows, interfaces and data exchanged with AI models; 

• prevent bias and regularly measure the performance of the models; 

• ensure that customer data is not reused for other purposes without a legal basis or an appropriate contractual framework. 

The European Regulation on Artificial Intelligence, also known as the AI Act, provides for the phased implementation of its obligations depending on the level of risk and the nature of the systems concerned. In a contact centre, particular vigilance is required when AI is used to assess staff, profile individuals, grant access to a service, or inform decisions that have significant consequences. 

The reference text is available on EUR-Lex — Regulation (EU) 2024/1689 on artificial intelligence.

A thorough assessment must not be limited to statements such as ‘data hosted in France’ or ‘secure cloud’. It must involve teams from customer relations, security, IT, compliance, procurement and legal. 

Organisations can structure their analysis around six key questions: 

1. What data is processed? Calls, recordings, written conversations, attachments, transcripts, CRM data, logs and administrative data must be identified. 
2. Where is it hosted and backed up? The answer must cover production, pre-production, backup, analytics and support environments. 
3. Who has access to it? Access rights, authentication, logging, support interventions and subcontractors must be documented. 
4. What evidence of security is provided? Qualifications, certifications, audits, security policies, incident response procedures and availability commitments must be verified. 
5. How are AI applications regulated? The models used, the data transmitted, the locations where processing takes place, guarantees against re-use and human oversight must be identified. 
6. Is the solution reversible? Export procedures, formats, timeframes, costs and secure deletion following data return must be planned for at the time the contract is drawn up.