NIS2

UK Cyber Security and Resilience Bill (NIS Regulations): Xelion and UK cyber security legislation

Xelion falls within the scope of organisations affected by the UK’s network and information systems security regime. In 2021 we started building our Information Security Management System (ISMS), which is now ISO/IEC 27001 certified.

Key components of the ISMS include risk assessments, vendor reviews, continuous awareness training, PEN testing, vulnerability management and a mature incident logging and response process. These components also form a large part of the foundation of the UK’s Network and Information Systems (NIS) Regulations 2018, which are currently being strengthened through the Cyber Security and Resilience Bill going through Parliament. Xelion already complies with most of these requirements, and we are working hard to be fully compliant well before the Bill becomes law.

In the Netherlands, where Xelion is headquartered, we are registered as an “important entity” in the NIS2 entity register of the Dutch National Cyber Security Centre (NCSC), under the Dutch Cyber Security Act.

Business Continuity

Being prepared for all imaginable risks

The continuity of our service is critical. If a customer can’t make or receive calls, the impact is immediate. We keep an inventory of technical and organisational risks, with a documented procedure for every scenario. We test those procedures through regular simulations of conceivable and unthinkable scenarios. You can read more in the article on business continuity and disaster recovery.

For example, Xelion is hosted in world-class AWS data centres with multiple levels of redundancy, and partner and user instances are never held on the same server, so in the unlikely event of an outage for one, the other won’t be compromised.

Vulnerability Management

Daily vulnerability scanning

We scan our most important assets for vulnerabilities every day. As soon as anything is found, we’re informed instantly and take the necessary measures to reduce the risk.

PEN Testing

Digital hacking for the advanced

We regularly carry out PEN tests, both internally and through external parties, to identify vulnerabilities and confirm our security-by-default and privacy-by-default approach. We encourage customers and partners to carry out their own PEN tests too. Please arrange this with us first so we can coordinate and support where necessary.

Bug Bounty programme

Appreciation for found vulnerabilities

Through our Responsible Disclosure programme, ethical hackers can report vulnerabilities to us. An appropriate reward is given based on impact and likelihood.

Privacy statement

Do what you say, and say what you do

Xelion processes data through a number of channels, including our website, mobile apps and desktop app. Our privacy statement explains clearly which data we process and why. Whenever new features go live, we update it so you always know exactly what privacy-sensitive data we process.

Use of our software 

Alongside our privacy statement, our Terms of Use apply when you use the Xelion software and associated services. They describe the conditions under which the software may be used, and the rights and responsibilities of users. The full Terms of Use and licence conditions are set out in the Xelion End User Licence Agreement (EULA).

UK GDPR

Data Protection Regulation

Xelion strictly adheres to the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018, as well as the EU GDPR where it applies to our EU customers and operations. We’re transparent about our data processing and its legal basis, and we uphold the rights of data subjects. Our technical and organisational measures include risk assessments and privacy training for employees.

We enter into the data processing agreement with the reseller or distributor. As an end customer, you arrange your data processing terms with your reseller.

AI & data processing

Transparency about AI within Xelion

Optional functionalities within the Xelion platform may use artificial intelligence (AI). They’re used only on the reseller’s instruction and within the agreements set out in the applicable data processing agreement.

Application of AI within Xelion

• Transcription:Call recordings are converted into text via the processor Bumicom. Transcriptions remain stored within the Xelion environment. 
• Analysis of transcriptions:Transcriptions can be analysed automatically via Ipster. The analysis is anonymised and follows a fixed methodology with uniform criteria and predefined categories. Ipster works only with the transcription and has no access to the audio recording.
• AI Assistants: AI assistants can handle calls via SIP when configured as a user. The caller’s telephone number is processed to enable the interaction.

Which data is processed?

Depending on the functionality activated: audio recordings, call metadata, transcriptions, callers’ telephone numbers, and configuration settings and text-based instructions within the portal. No additional personal data is processed beyond the functionality enabled by the reseller.

Models used

Ipster, Kollie and COTU are optional sub-processors. Details of the language models they use are available on request.

Use of data for training

Personal data processed through the Xelion platform is not used to train or improve general AI models belonging to Xelion or third parties, unless explicitly agreed in writing. Where third-party AI technology is used, it is contractually limited to delivering the agreed service.

Retention periods

AI output, including transcriptions and analysis data, is currently stored for one year within the Xelion environment. The per-tenant retention setting does not yet apply to AI output. This is in development.

Automated decision-making

AI functionality within Xelion is supportive in nature. No fully automated decisions with legal effects, or similarly significant consequences for individuals, are made without human intervention.

Security

AI processing is subject to the same technical and organisational security measures as the rest of the platform, including encryption in transit, access control, logging and monitoring.

International data transfers

AI processing takes place within the Netherlands, with the exception of COTU, whose underlying language model is hosted in the United States (see sub-processors below). For optional services that rely on a platform outside the UK or EEA, such as WhatsApp, this is stated under the relevant sub-processor, and appropriate safeguards are applied in line with UK GDPR and, where relevant, EU GDPR.

Data separation

Data is not shared between customers. Processing takes place within the isolated environment of the relevant reseller or end customer.

Responsibility

As data controller, the reseller remains responsible for informing data subjects about the use of AI within their services. Xelion will provide additional information on request to help resellers meet their transparency obligations.

EU AI Act: Kollie, Ipster and the AI Act 

Kollie, Ipster and the AI Act

Kollie Voice AI

Since 2 August 2026, a key part of the EU AI Act has applied: an AI system that communicates directly with a person must make this clear, so the caller knows they’re speaking to an AI system and not a human.

Kollie can tell the caller on every call that they’re speaking to an AI system. The user sets up this notification in the configuration. If it isn’t set up, responsibility lies with the reseller and the user, not with Xelion.

Kollie does not fall into the AI Act’s high-risk categories. It isn’t used for credit scoring or to determine access to essential services. Every call with Kollie can be transferred to a member of staff. AI doesn’t replace the conversation. It only handles the first part of the interaction.

Call analysis via Ipster

Ipster is used to give insight into why people are calling, not to assess employees. It only ever receives the transcription of a call, never the audio recording. Any sentiment analysis is based on the text. Voice characteristics such as pitch, pace or intonation are not analysed, so there is no emotion recognition based on biometric data, as defined in Article 3(39) of the EU AI Act.

The reseller decides what data and access the system is given, and therefore what type of use applies. Using Ipster for customer experience is different from using its output to assess employees, which falls under Annex III of the AI Act. Deciding which situation applies, and meeting the resulting obligations, is the user’s responsibility, not Xelion’s.

Sub-processors

Overview of our sub-processors

Overview of our sub-processors

Xelion uses carefully selected sub-processors to deliver its services. Each one must meet clear requirements, aligned with UK GDPR (and EU GDPR where applicable) and relevant ISO standards:

• A data processing agreement is in place with every sub-processor
• They implement appropriate technical and organisational measures to protect personal data
• They act solely on the instructions of, and for the benefit of, Xelion and its customers
• We evaluate their compliance with privacy and security agreements periodically

Standard sub-processors form part of the core Xelion solution. We communicate any changes to them as set out in the data processing agreement. Optional sub-processors are only used if the reseller activates the relevant functionality, and if anything changes with one you use, we’ll let you know.

COTU

COTU provides the AI voice bot service within Xelion. When a caller interacts with an AI assistant, the audio is processed directly using a speech-to-speech model. After the call, a transcript is made available in the portal for reference. The transcript is not analysed, classified or scored. It’s stored with standard call metadata such as call ID, caller phone number, date and time. No anonymisation or pseudonymisation is applied, and it isn’t processed further by COTU or its suppliers.

Customer data is never used by COTU, or any of its sub-processors, to train or improve AI models. All processing takes place strictly on behalf of Xelion and its resellers, under a data processing agreement that meets UK GDPR requirements. Customer configuration, knowledge bases and transcripts are hosted on UK infrastructure. The underlying language model is hosted in the United States. COTU has contracts and data processing agreements in place with the LLM provider that include the safeguards required under UK GDPR and EU GDPR.

 Authentication

We protect your valuable communications data

Xelion uses a management tool to manage multiple servers and tenants. In addition to a strong password, two-factor authentication (2FA) is required to log in to it, and we record exactly who logged in, where and when. The desktop app and mobile apps also require a second factor. We also offer an OpenID integration with Microsoft Entra ID, so users can log in and set up 2FA through Microsoft 365. Read more about the Microsoft Entra ID integration.

Access by Xelion

No access without permission

Xelion employees can only access a tenant with the reseller’s permission. They log in via the management tool, so every login and management action is recorded in the audit log.

Password policy

Policies are nice, but measures are better

We enforce strict password requirements for staff and systems, and expect the same of our suppliers. Policy alone is no guarantee, which is why technical measures stop insecure passwords from being used.

Secret Share

Encrypted information transfer

Sensitive data such as access credentials, logs and backups is never sent unencrypted. Instead, we use our Secret Share tool, where data has a shelf life of between 5 minutes and 1 week. It can be destroyed once read and protected with an additional password. Secret Share is also available to external users via secretshare.xelion.com.

Awareness

No security without awareness

Our awareness training goes far beyond locking your PC, avoiding USB sticks and using strong passwords with MFA. We regularly “hack” ourselves to show where risks lie within our organisation and products. Our e-learning programme is based on a gap analysis, so we know exactly where our knowledge is sufficient and where more attention is needed. It includes modules relevant to every department, such as detecting vishing and deepfakes for our support teams.

Phishing simulation

Recognising fake emails

Phishing remains a major cause of data breaches. Despite measures such as detection and alerting, we regularly run phishing simulations so employees keep recognising fake emails.

Incidents

How do we handle security incidents?

An incident can come from anywhere: our own monitoring, a report from a partner or customer, or our Responsible Disclosure programme. Reports go to our Security Officer, who can be reached by email 24/7.

Every incident is logged and assessed for impact and urgency as part of the incident management process within our ISMS. Our response times are set out in the product service description.

How we inform partners depends on the nature and scale of the incident. Where the impact is broad, we use the status page at status.xelionsystems.com or send an email. If it affects a smaller group, we phone them. All communication is logged.

We also meet our statutory reporting obligations. Significant incidents are reported within the deadlines set by the applicable NIS legislation, and personal data breaches in line with UK GDPR and the data processing agreement. 

Afterwards, we review every incident. What we learn feeds back into our risk assessment and measures.

Continuity

Business continuity and disaster recovery

If a customer can’t make or receive calls, the impact is immediate. That’s why we’ve mapped the technical and organisational risks to our services, with a documented procedure for every scenario, including a disaster recovery plan. We test these plans periodically in line with the schedule in our ISMS, simulating conceivable and unthinkable scenarios. A plan that only exists on paper means little. Only when it works in practice do we know continuity is guaranteed. Details of the platform’s redundancy and backups are set out in the product service description.

Platform

How is the Xelion platform secured?

The Xelion platform is hosted in the Netherlands. Signalling and voice between apps, devices and the platform are encrypted with TLS 1.2 or higher, preferably TLS 1.3. Passwords are never stored in readable form. They are hashed with BCrypt.

Access is tightly controlled. Logging in to the management tool, desktop app and mobile apps requires 2FA, and every login and management action in the management tool is recorded in the audit log. Access can also be restricted with IP restrictions.

Xelion doesn’t provide trunking itself, so monitoring for toll fraud on outbound traffic is handled by the trunk provider. IP restrictions in Xelion also let you limit who can reach the platform.

We roll out updates on a fixed cycle using a ring-based system. A new version goes to a limited group first and only then more widely, so we can always step in before an issue affects every customer. Partners receive the schedule two to four weeks in advance. Critical patches go live as quickly as possible, depending on the fix.

Data

Retention, logging and deletion

How long we keep data depends on the type of data. We keep configuration data for as long as the environment exists. Since version 9.8, you can set your own retention period for customer data per tenant. AI output is currently stored for one year. The retention setting doesn’t yet apply to AI output. This is in development.

Deleted customer data is overwritten at tenant level and is then gone from the production environment. Backups are read-only and go back three to five days, depending on the service. After that, deleted data is gone from the backups too. Tenants are deleted by the reseller, and the associated data is removed from backups within a maximum of five days.

Login activity and management actions are recorded in the audit log. You can find out which actions are logged in the administrator manual on the partner portal.

Entra ID

The Microsoft Entra ID integration

Xelion offers an OpenID integration with Microsoft Entra ID. Users log in with their Microsoft account, and the second factor runs through Microsoft 365. The integration works via the Xelion Enterprise App in Entra ID, and activation requires admin consent. When approving it, your Microsoft tenant administrator can see exactly which permissions the app requests. We’ll shortly add an overview of those permissions, and what we use them for, to this page.