Trust
The commitments that matter when you sign. Read first, sign second.
Three objections come up from dental, medspa, and law-firm buyers before they sign: consent, regulated-vertical handling, and who actually owns the data afterwards. This page lays the commitments out, in writing — the same line items that land in the contract.
Scroll to the three sections that follow. If something keeps you up at night that we haven't covered here, write it in the intake and we'll come back with the signed language.
Why this page exists
The commitments — in writing, before signature.
Every Plumbline engagement ships the same three commitments, regardless of vertical. They aren't marketing language — they're the line items that get written into the engagement contract before any workflow goes live. Read them. Question them. If something here disagrees with what the call promised, the contract version wins.
01 · TCPA consent
Every AI-driven text and call is consent-gated.
Outreach on your behalf never lands without prior-express-written-consent captured, logged, and auditable. The consent log is the property you hold — exported on request, deleted on offboarding.
- Prior-express-written-consent captured at intake — the signed record (or recorded-permission log) lands in the consent log before the first outreach is sent
- Opt-out mechanism honoured immediately — STOP, UNSUBSCRIBE, or a verbal revoke removes the contact from the active queue
- Time-of-day windows honour the contact's local timezone — after-hours is real after-hours, not 3am
- Per-conversation consent log retained and exportable — every outreach returns a dated record tied to a specific contact
- AI-disclosure on first touch — the contact knows they are talking to a system before any data is captured
02 · HIPAA handling
PHI stays inside the stack you already trust.
For dental and medspa engagements, every wire that touches protected health information passes through a HIPAA-eligible sub-processor under a signed BAA — never a general-purpose AI endpoint.
- PHI only travels through HIPAA-eligible sub-processors — the BAA is signed and in scope before the first wire goes live
- Per-contact audit trail — every handling action is timestamped and tied to a specific user record
- No model training on client data — your conversations never become anyone else's training set
- Regional silos for dental and medspa engagements where state law layers on top of HIPAA
- Offboarding runbook written into the signed contract, not a separate SOW you have to ask for
03 · Data ownership
Your leads, transcripts, and CRM records — yours.
We don't warehouse a parallel copy of your data. What lives in your CRM is the system of record. Exports land within one business day; deletion lands within 30 days of offboarding, in writing.
- Every lead, transcript, and CRM record remains in the stack you already pay for
- We don't warehouse copies of your leads — what lives in your CRM is the system of record
- Exports on request, in CSV or JSON — any field, any date range, within one business day
- Hard deletion of our access within 30 days of offboarding; written confirmation when the deletion is complete
- No behind-the-scenes copy sits in a shadow store — the audit log is the only exception, and it lives inside your tenancy
Convinced?
Read the commitments above, then start the engagement.
Pick the path that fits — a one-page audit note (asynchronous, free) or a 30-minute call (synchronous, free). Either way, the contract lands with the three commitments above written into it.
Already read this? Skip ahead to the audit or the call.
Plumblinetrust & compliance commitments: TCPA consent for AI-driven outbound, HIPAA handling for dental and medspa engagements, and contract-level data ownership for leads, transcripts, and CRM records.