--- title: Questions and answers url: https://alta-sec.com/faq description: Plain answers about how AltaSec tests AI chatbots and voice agents, what we need from you, how your data is handled and what is ready today. updated: 2026-11-11 language: en --- # Questions and answers Plain answers about how we test, what we need from you, and what is ready today. ## The basics ### What does AltaSec do? We test customer-facing AI chatbots and voice agents for security, real customer journeys and language quality. You get a go / no-go verdict for every journey, language and channel, with the evidence. ### How is this different from a penetration test? Penetration tests and scanners look at servers and code. We test how your chatbot or voice agent behaves when someone talks to it: whether it answers right, leaks data or gets talked into breaking your rules. ### What is the Passport? Our go / no-go verdict for every journey, language and channel, with the conversation behind each verdict, a fix per finding and a list of what we did not test, and why. Not tested is never counted as a pass. ### Do you issue a certificate? No. The Passport is our verdict with evidence, never a certificate or badge. ### Who judges the conversations? Automatic checks catch wrong amounts, dates and leaked data. AI judges from a different model family than your chatbot score each conversation. Native speakers check those judges, and we only rely on a judge in a language once it agrees with them. That calibration is in progress. ## What we test ### Do you test for prompt injection and jailbreaks? Yes, in chat today and by voice next. We run [prompt injection](https://alta-sec.com/prompt-injection-testing), jailbreak and data-extraction attempts, in English today and in Romanian and European Portuguese next, and check every reply for leaked data. ### How do you test a voice agent? A voice agent fails in one of three places: it mishears (speech-to-text), misunderstands (the AI model) or says it wrong (text-to-speech). We measure each part on recorded calls, so you know which one to fix. Testing your own voice agent by phone is coming soon, and security tests and customer simulations by voice are next. More on [voice agent testing](https://alta-sec.com/voice-agent-testing). ### Which languages do you test? Security attacks run in English today. Romanian and European Portuguese are next for chat, and already measured on recorded voice calls. Dutch and more European languages come after that. ### When should we test? Before launch, and again after every change to the model, the prompts or the knowledge base: any of them can break something that worked. ## Getting started ### What do you need from us? Access to your chatbot or voice agent (an endpoint or a test chat; a test phone number once telephony testing launches) and your written authorization. No access to your code. You tell us which journeys, languages and channels matter and what it must never do; we turn that into tests. ## For your security and legal review ### Where is our data? In the EU only, with every sub-processor named in our data processing agreement. ### What will you access? Only the endpoint or test chat you authorize in writing, within the limits we agree. Never your code. ### What happens to the evidence? You keep the Passport and its evidence. Our copy is pseudonymised and deleted when the engagement closes. ### Does it fit our frameworks? Next: every finding will be tagged with a failure mode and pointed at the OWASP Top 10 for LLM Applications, NIST AI RMF and the EU AI Act, as input for your own assessment, never as a compliance verdict. ## What’s ready today, and what’s next What’s ready | | Chat | Voice | | --- | --- | --- | | AI security | **Live** | **Next** | | Customer simulations | **Simulated** personas are built; graded results are next | **Next** | | Language benchmarks | **Simulated** Romanian and European Portuguese attacks are not run yet | **Recorded** Romanian and European Portuguese; English next | | Compliance evidence | **Simulated** findings pointed at OWASP, NIST AI RMF and the EU AI Act | **Next** | **Live** runs today against our lab agent. **Recorded** uses real numbers from recorded runs. **Simulated** is a worked example, not graded. **Next** is planned. Your team watches every run in the console. See the whole [platform](https://alta-sec.com/platform). ### Next (in development) - AI security and customer simulations by voice - Step-by-step scoring of customer simulations - Dutch and more European languages - Real-world call conditions - A re-test comparison after every release - Security attacks in Romanian and European Portuguese in chat - Graded results for the simulated customers - Calibrating the AI judges against native speakers, language by language - Testing your own voice agent by phone - Findings tagged with a failure mode and pointed at OWASP, NIST AI RMF and the EU AI Act - An AI assistant and an MCP connection in the console, so your own agents can read your results ### Later (planned) - Agents that take actions (bookings, payments, customer records) - Attacks through tools, memory and the hand-off to a human agent - Voice cloning and spoofing tests - Monitoring live conversations after launch ## Contact Book a call: email contact@alta-sec.com with the subject "AI agent check". Tell us which chatbot or voice agent you want tested, what it does, and in which languages and channels.