Security questions before you automate remodeling intake
Remodeling intake is a sensitive call
A kitchen or bath remodel starts with a conversation most operators do not think of as sensitive. The agent asks what the homeowner wants to spend, whether they are looking at financing, who else lives in the house, when they are home during the day, and how soon they want work to start.
Put that in a database and you have household income signals, a credit-adjacent conversation, an occupancy schedule, and a property address. That is a richer profile than most operators realize they are creating on a first call. The question is not whether to automate intake. It is what the vendor does with what the automation hears.
The six questions that settle it
First: Is the security report Type I or Type II, and what was the observation window? Type I says the controls were designed correctly on the audit date. Type II says they operated correctly for 6 to 12 months while an auditor sampled evidence. Only one of those describes a program that has actually run.
Second: Will you share the report under NDA, or only the badge? Third: Is our call data used to train models serving other customers? Fourth: What CRM permissions does the agent hold, and can they be scoped to writing appointments rather than reading the full customer record?
Fifth: How long are recordings and transcripts retained, and what happens to them when the contract ends? Sixth: Who at the vendor can pull a recording of one of our calls, and is that access logged? A certified vendor answers all six in a sentence each.
Why financing talk raises the stakes
Financing is where remodeling intake separates from a normal service call. The agent is not running a credit check, but it is having the conversation that leads to one, and it is recording the homeowner describing what they can afford. That recording sits somewhere. Knowing where, for how long, and who can hear it is a reasonable thing to require before you route your main line into it.
There is a commercial reason to care as well as a compliance one. Budget signals are the most valuable field in a remodeling database. A vendor that trains shared models on aggregated customer conversations is learning what homeowners in your market will spend, and serving that model to whoever else buys the product. Your qualifying data is an asset, and it should stay yours.
Ask for the answer in the contract rather than on a sales call. A commitment that your data is not used to train shared models costs a vendor nothing to make if it is already true, and it is the one term nobody volunteers.
Remodeling AI platforms compared
Capability | Hatch | Heavyset | Leaping AI | Revin |
|---|---|---|---|---|
SOC 2 Type II certified | Yes | No | Yes | Yes |
Trained on your own call recordings | No | No | No | Yes |
Voice agent for the high-ticket qualifying call | Yes | No | Yes | Yes |
Live booking into Lead Perfection and Builder Prime | No | No | No | Yes |
Proactive unsold-estimate recovery | No | No | No | Yes |
Certification is a floor, not a finish line
SOC 2 Type II covers how a platform handles your data. It does not cover how the agent behaves on the phone. Two things sit outside the report and matter on a remodeling line.
Opt-out handling is one. Revin forwards opt-outs and updates do-not-call lists automatically, so TCPA hygiene is part of how the agent runs rather than something your marketing coordinator has to remember before a follow-up campaign.
Configuration is the other. Most incidents start with a permission set somebody got wrong, not a control that failed. Revin runs a forward-deployed engineering model, so a dedicated AI engineer builds the CRM connection and scopes what the agent can reach. Nobody hands you a permissions dashboard and wishes you luck.
Sources: Hatch, Heavyset, and Leaping AI websites and public materials, August 2026.
What should remodelers ask an AI vendor about security?
Ask six things: Whether the report is Type I or Type II and the observation window, whether they will share it under NDA, whether your call data trains shared models, what CRM permissions the agent holds, how long recordings are retained, and who can access a recording. A certified vendor answers each in a sentence.
Is remodeling intake data considered sensitive?
It is more sensitive than most operators assume. A qualifying call captures budget, financing interest, household occupancy patterns, and the property address. Together that is a household profile, not a marketing record. It deserves the same vendor scrutiny you would apply to the CRM that stores it.
Does an AI intake vendor need access to my CRM?
It needs write access to create the appointment, but it rarely needs read access to your entire customer history. Ask whether the credential can be scoped to booking rather than full record access. Scoped credentials limit what a compromise could reach without limiting what the agent can do on the call.
What does SOC 2 Type II actually prove?
It proves an independent auditor examined the vendor security controls and confirmed they operated correctly across an observation window, usually 6 to 12 months. It is stronger than Type I, which only confirms the controls were designed correctly on the day of the audit. Enterprise buyers generally require Type II.
How long should a vendor keep remodeling call recordings?
The specific window matters less than having one written into the agreement, with a deletion commitment when the contract ends. Ask who can access recordings during that period and whether access is logged. A vendor that cannot state a retention period has not thought the question through.
About Revin
Automate intake without the security debt
Revin qualifies every remodeling lead and books the in-home consult into Lead Perfection or Builder Prime on SOC 2 Type II certified infrastructure.
