What a roofing intake call actually collects

A storm call is one of the richest data captures in home services. In four minutes an intake agent takes the homeowner name and property address, the carrier, the claim number if one is open, the deductible, the date of loss, roof age, sometimes the mortgage servicer or lienholder because the check will be made out jointly. Photos follow within the hour.

None of that is marketing data. It is a package that identifies a household, its property, and its insurance position. If it leaked, you would be notifying homeowners, not writing a postmortem. Most roofers put their CRM through a security review and then hand the same data to an AI intake vendor without asking a single question.

Where the data goes after the call ends

Three questions decide your exposure. Where are the recording and transcript stored, and for how long? Is that data used to train models that serve other companies, including competitors in your market? And what credentials does the vendor hold into your CRM, since an intake agent that books an inspection has write access to the system your production schedule runs on.

That last one is the part operators underestimate. You are not just sharing call data. You are granting a third party standing access to your customer database.

There is a second-order problem specific to roofing. Storm work concentrates geographically, so a vendor training shared models on aggregated customer calls is learning your market at the same time it learns your competitors. The claim volume, the carriers moving fastest, the neighborhoods generating calls after a given event: All of it is competitive information in a business where the first inspection usually wins the roof.

SOC 2 Type II is the answer to the question you are not qualified to ask

Most roofing owners are not going to audit a vendor architecture, and should not have to. That is what the certification is for. A SOC 2 Type II report means an independent auditor watched the vendor operate its controls across a window of 6 to 12 months and confirmed they held.

Type I only confirms the controls were designed on the day the auditor looked. Type II confirms they were actually running the whole time. When a vendor says SOC 2 without naming a type, that distinction is usually why.

Roofing AI intake platforms compared

A "No" on the first row means the platform publishes no SOC 2 certification. Several describe encryption and access controls, which are fine practices and not an audited report.

What to put in the contract, not the sales call

Get four things in writing before the number forwards. A retention period for recordings and transcripts, with a deletion commitment at the end of the agreement. An explicit statement that your call data is not used to train shared models. A scoped CRM credential, so the agent can write appointments without reading your full customer history. And a named contact who can pull a call recording, with that access logged.

A vendor certified today gives you all four in an afternoon. A vendor still working toward it gives you a roadmap, and your rollout waits on somebody else’s audit calendar.

Sources: Avoca, Sameday, and Lace AI websites and public materials, August 2026.