Information security
At Truecaller we have an unwavering emphasis on being at the forefront of data security. This is evidenced by the ongoing development of our data management processes to ensure that they are both robust and effective. Our agile organizational structure promotes this development and allows us to quickly adapt to new changes in the area of information security.
As a globally recognized platform for verification of contacts and blocking of unwanted calls, we have a major responsibility when handling user data. Our service is built on trust – trust that we maintain by implementing comprehensive security measures to protect all user data that we are entrusted with processing. These measures are designed to protect the data from unauthorized access, use, dissemination and destruction.
https://www.truecaller.com/information-security-policy-statement
Cybersecurity
At Truecaller we take cybersecurity very seriously and make every effort to protect our company’s assets, employees and user data, while also constantly being at the forefront of leveraging new technology. Our comprehensive cybersecurity program guarantees that our systems and data are protected. Our security measures rely on several levels of security – from advanced firewalls, infringement prevention systems, fundamental security principles and encryption methods, as well as rigorous authentication processes. We also constantly monitor our network, applications, systems and user interfaces.
Our security management involves the use of a comprehensive information security management system (ISMS) to ensure that we are focused on and prioritizing our efforts where it counts.
Our ISMS is based on a set of principles and best practices, which are constantly reviewed and updated to align with industry standards such as ISO 27001, NIST Cybersecurity Framework and SANS CITS Critical Security Controls.
The ISMS system is designed to identify, evaluate and prevent potential risks, while our management structure is responsible for overseeing the systems and ensuring that they are aligned with applicable standards, regulations, privacy provisions and customer expectations.
Data Privacy
Truecaller is obliged to comply with many regulations regarding data security in the markets where we have a presence. We must also carefully monitor developments in data protection in these markets to ensure that we can be proactive in introducing best practices and be ready to follow them. We allocate substantial resources in order to take the steps necessary to ensure compliance. The Privacy Center on our website, truecaller.com/privacy/ privacy-center, is kept updated and we have a robust framework of policies:
• Data Breach Response Policy
• IT Security Training Policy
• Access Control Policy and Access Management Policy
• Encryption Policy
• Information Security Policy
• Group Data Governance Policy
• Data Storage Policy
Privacy management
Truecaller believes that a clear management structure for personal privacy and data protection provides a solid foundation for an open and trusting relationship with our users and a culture within Truecaller that is distinguished by integrity. To ensure continuous compliance with applicable laws, Truecaller has created its own governance model. Truecaller’s model includes a dedicated data protection unit with specific areas of responsibility and assignments to manage the implementation and maintenance of the compliance program for integrity and data protection within the organization.
To firmly establish the management structure, Truecaller appointed “Privacy Champions” within each team to develop protection measures, support the compliance program and ensure that all departments and units take responsibility for protecting personal data.
These Privacy Champions offer support, for example to maintain processing activity logs and personal data assistance.
See in-depth descriptions and comments in our ESG Reports and Disclosures section and our privacy centre webpage .
Responsibility for privacy and data security :
Our Senior Compliance Officer is Truecaller's Global Data Protection Officer (DPO) and governs all of Truecaller's data protection practices and risks.
VP, Information Security is Truecaller's Global CISO and governs information security and resilience practices including operational risk control.
Data protection programs covering suppliers and business partners :
Truecaller has established a comprehensive data protection program that extends to suppliers and business partners handling our data or accessing our network. As part of our contract management policy, we require all relevant partners and suppliers to enter into Data Processing Agreements (DPAs) whenever they have access to personal data. These agreements include provisions ensuring adherence to our privacy and security standards, as well as a right to audit vendors to verify compliance . To further enforce and streamline this policy, we are implementing an automated vendor procurement process that will systematically capture and enforce these requirements. Additionally, our privacy policies and Code of Conduct explicitly affirm our commitment to ensuring that all suppliers maintain appropriate security measures and comply with applicable data protection laws.
Code of Conduct has a reference that too (Section 6.6).
Policies and procedures
As part of our commitment to sustainability, we have developed a robust framework of policies, the most fundamental of which is our Group Privacy and Data Protection Policy. This policy underscores our commitment to protecting personal data and ensuring compliance with global privacy standards, including the EU General Data Protection Regulation (GDPR), India’s Digital Personal Data Protection (DPDP) Act of 2023, and other relevant legislation. We regularly review and update our framework to adapt it to the evolving regulatory landscape and new technologies, and ensure ongoing compliance with data protection requirements.
Employee training and awareness
Truecaller’s compliance program is comprehensive and includes company-wide training for all employees in key areas of data protection, including handling users’ requests, sharing personal data, information security, data breaches and records management.
The Global Privacy and Data Protection Training also explains our privacy program, including what its goals are, what it requires our employees to do, and what their responsibilities are when it comes to handling personal data responsibly, transparently, and in compliance with Truecaller’s
standards. To cultivate a corporate culture within Truecaller, where privacy awareness is high, attendance is mandatory for all employees, including consultants, contractors and interns.
Implementation rate in information security training :
Refresher training in information and security - 93%
Training on the Code of Conduct and business ethics - 100%
Training on global data protection - 100%
Truecaller's Board of Directors holds overall responsibility for risk management and internal control. The Audit Committee, made up of non-executive directors, reviews the effectiveness of risk management, internal control and compliance, and reports its findings to the Board.
Risk ownership sits with the business. Product, engineering and function owners identify, assess and treat the risks in the systems and services they run.
Information security and IT risk is overseen by the VP IT & Information Security, who sets control standards, maintains the central risk register and reports on risk and compliance status to the Management Team and the Audit Committee.
Risks are recorded with a named owner, a treatment plan and a review date. Material risks are escalated to the Management Team and the Board.
Independent assurance comes from annual external certification audits of our management systems against ISO/IEC 27001 (information security), ISO 22301 (business continuity) and ISO 9001 (quality), together with internal audits carried out ahead of each certification cycle.
Data Protection and AI
Truecaller develops innovative AI capabilities while ensuring compliance with data protection laws and mitigating risks associated with emerging technologies. We conduct impact assessments to identify high-risk areas and collaborate with internal stakeholders to maintain oversight. Privacy by design principles are applied throughout the development process. Complying with data protection laws and respecting user privacy are central to Truecaller’s strategy, with privacy-preserving practices embedded across all stages of our service and product life cycles. By integrating regulatory guidance into our operations, Truecaller not only drives AI innovation but also strengthens trust and accountability, ensuring that our systems meet both legal and ethical standards. We also closely monitor global regulatory developments in AI and data protection to stay aligned with evolving requirements and best practices.
Responsible Use of Generative AI
Truecaller has established AI at Work Guidelines for employees to support the responsible and secure use of generative AI in the workplace.
The guidelines apply to all Truecaller employees using third-party AI services for work-related purposes and provide clear principles for protecting company data, intellectual property, confidential information, and user trust, while enabling employees to leverage AI responsibly to drive innovation and efficiency.
The guidelines complement our existing information security, privacy, and data protection practices. AI used in Truecaller’s customer-facing products is subject to separate product development, security, privacy, and governance processes.
Through these guidelines, Truecaller promotes responsible AI adoption, employee awareness, and appropriate safeguards when using AI tools at work.
Certifications
Truecaller has successfully attained three ISO certifications:
- ISO 27001 for Information Security Management
- ISO 9001 for Quality Management Systems
- ISO 22301 for Business Continuity Management
These certifications mark a significant milestone in Truecaller's commitment to the highest global standards of security, resilience, and quality in its operations.
ISO 27001 (Information Security Management) :
This certification assures that Truecaller has implemented rigorous security measures to protect sensitive data, solidifying the company's position as a trusted platform for over 420 million active users. It strengthens our information security posture and it shows that we are fully committed to protecting the data of our users and partners. In a time where security threats are evolving rapidly, this certification demonstrates that Truecaller stays ahead of the curve.
ISO 9001 (Quality Management System) :
This certification highlights Truecaller's commitment to consistently providing high-quality services and products, meeting both user expectations and enterprise client requirements.
ISO 22301 (Business Continuity Management) :
This certification underscores Truecaller's ability to maintain seamless service delivery even during unforeseen disruptions, ensuring uninterrupted operations for its users and business clients.
It's a comprehensive framework that further boosts trust and reliability for our users and partners. We have always undertaken information security as a key enabler for customer trust and satisfaction.
We are required by our ISO Certifications to undergo audits annually including internal audits and ISO-ackriteded external audits on our management systems.within the following categories: Information Security, Business Continuity Management and Quality Management.