As of October 2026, unitQ Support QA, evaluagent, Level AI and IrisAgent publicly state both a SOC 2 Type II report and automatic PII redaction in conversations. Zendesk QA is SOC 2 Type 2 audited and offers PII masking through a paid add-on. Rippit and Lorikeet hold SOC 2 reports but don’t describe transcript redaction, so ask.
Last updated November 1, 2026. Written by the unitQ team. unitQ makes unitQ Support QA, one of the platforms below. We checked every security claim against each vendor’s own public security, trust or pricing page in October 2026 and link those pages in the sources. Where a vendor doesn’t publish something, we say so rather than guess.
Every platform on this list says it holds a SOC 2 report. Far fewer say, on a public page, that they redact PII from conversation transcripts. As of October 2026, unitQ Support QA, evaluagent, Level AI and IrisAgent publicly state both, and Zendesk QA offers PII masking through a paid Zendesk add-on.1691113
The rest of the security question depends on who your QA vendor is grading. If AI agents now answer a share of your tickets, the safest setup keeps the grader separate from the bot vendor and limits who can see raw customer data.
The short answer
unitQ Support QAbest for an independent grader of human and AI agents, with PII removed before storage, SOC 2 Type II, HIPAA and dedicated cloud deployment options.Jump to unitQ Support QA →evaluagentbest for published PII redaction on every account, with SOC 2 Type II and per-user pricing.Jump to evaluagent →Level AIbest for regulated voice contact centers that need HIPAA and HITRUST, with PII redacted before AI processing.Jump to Level AI →Zendesk QAbest for teams already on Zendesk who can add Zendesk’s data privacy add-on for PII masking.Jump to Zendesk QA →Rippit (formerly MaestroQA)best for the widest published certification list, including PCI DSS 4.0 and ISO 27001.Jump to Rippit →IrisAgentbest for teams that want redaction before storage and a private deployment, and are open to buying the AI agent from the same vendor.Jump to IrisAgent →Lorikeetbest for teams that want an AI agent and QA in one contract, with a HIPAA BAA and data residency options.Jump to Lorikeet →
How we evaluated
We scored each platform on six things a security review will ask about, using only what the vendor publishes:
Audit evidence
Does the vendor say it holds a SOC 2 report, and which type? A SOC 2 report is an independent CPA’s examination of a service organization’s controls, under standards the AICPA sets.4 Ask for the report, not a badge.
PII redaction
Does the vendor say it removes or masks personal data (names, card numbers, Social Security numbers) from transcripts, and when: before storage, before AI processing, or only on display? NIST’s guide to PII confidentiality says PII should be protected from inappropriate access, use and disclosure, at a level that fits the context.5
Health data
Does the vendor state HIPAA support or offer a business associate agreement?
Deployment control
Is there a private, on-premise or region-specific option?
AI agent coverage
Can it score bot and AI agent conversations as well as human ones?
Independence
Does the vendor also sell the AI agent it grades? If so, the same company writes the answers and the report card.
We didn’t rank on price, because most security add-ons are quoted. Where a vendor publishes a price, we include it.
The best secure support QA platforms, compared
1unitQ Support QA: best for an independent grader with PII removed before storage
unitQ Support QA scores 100% of connected support conversations across chat, email, messaging, voice and IVR, against rubrics you write.2 It scores AI agents and bots on a shared standard or on bot-specific rubrics, independently of the vendor that sold the bot, and unitQ doesn’t sell the agent, the platform or the labor it grades.2 That separation is the security argument: the company holding your QA data isn’t the company whose bot it’s judging.
On security, as of October 2026, unitQ states:1
- PII is removed in the data pipeline before conversations are stored or scored. That covers names, addresses, phone numbers, email addresses, credit card and Social Security numbers, URLs, dates, numeric sequences and passphrases.
- Two detection layers: named-entity recognition models hosted in unitQ’s own environment, plus Google Cloud DLP as a second pass.
- A SOC 2 Type II report, audited annually and available on request.
- HIPAA, GDPR and CCPA compliance.
- AES-256 encryption at rest and TLS 1.2 or higher in transit.
- Regular third-party penetration testing and SAML 2.0 single sign-on.
- Dedicated cloud deployment options for enterprises with strict residency or sovereignty needs.
- Hosting on Amazon Web Services, Google Cloud Platform and Microsoft Azure.
You can also define pass/fail compliance checks, such as required disclosures and privacy handling, and score every conversation against them.3 That tells you whether an agent or a bot mishandled personal data in the conversation itself.
Best for
teams that want an independent grader for human and AI agents, with PII redacted before storage and a dedicated cloud option. See unitQ Support QA.
Choose it when
you run AI agents from another vendor, want one owner-controlled scorecard across in-house, BPO and AI agents, and need PII kept out of storage.
The honest trade-off
unitQ doesn’t list an ISO 27001 certification. Retention settings and business associate agreement terms aren’t published, so request them during your security review. SCIM user provisioning is still on the roadmap.1 Pricing is quote-only.
2evaluagent: best for PII redaction included by default
evaluagent lists “PII redaction & entity recognition,” automatic masking of sensitive data in transcripts and custom redaction rules on its pricing page, alongside SOC 2 Type II and GDPR.6 Its Auto-QA page says redaction is included as standard across all accounts.7 It scores human and AI agents, and its AI Agent Observability module grades bots built by Cognigy, Sierra, Decagon or in-house teams against the same standard as your human QA program.8
Trade-offs: as of October 2026, the pages we checked don’t mention HIPAA or a private deployment option. Its trust center blocked our request, so confirm the details there.
Best for
teams that want PII redaction included by default, with transparent per-user pricing.
Choose it when
redaction-by-default matters more than deployment control. Pricing starts at $35 per user per month, with AI agents priced per conversation.6
3Level AI: best for regulated voice contact centers
Level AI’s security page lists ISO 27001, SOC 2 (Type II reports through its Trust Center), HIPAA, HITRUST and GDPR, and says names, card numbers and Social Security numbers are automatically redacted before any AI processing.9 It scores calls, chats, emails and bot conversations.16
Trade-offs: Level AI also sells AI virtual agents,17 so if you buy both, the same vendor builds and grades the bot. Pricing is quote-only.
Best for
regulated voice contact centers that need HIPAA and HITRUST.
Choose it when
voice is your main channel and health data is in scope. See unitQ Support QA vs Level AI for a side-by-side.
4Zendesk QA: best for teams already on Zendesk
Zendesk says its QA product undergoes an annual SOC 2 Type 2 audit, is GDPR compliant and HIPAA-enabled, lets you choose a data retention period and can hide selected content from agents and admins.10 Zendesk’s trust center describes automatic credit card redaction and an Advanced Data Privacy and Protection add-on with PII masking and bring-your-own-key encryption.11 AutoQA scores AI agent conversations alongside human ones.10
Trade-offs: fuller PII masking sits in a paid add-on. Zendesk also sells AI agents,25 so the vendor grading the bot is the vendor that built it.
Best for
teams already on Zendesk.
Choose it when
your conversations already live in Zendesk and procurement prefers one vendor. Compare it with unitQ Support QA vs Zendesk QA.
5Rippit (formerly MaestroQA): best for the longest published certification list
Rippit’s trust center lists a SOC 2 Type 2 report covering security, confidentiality and privacy, ISO 27001, PCI DSS 4.0 Level 1, a HIPAA Type 1 attestation, GDPR and CCPA, with encryption at rest, in transit and in backup, and configurable data retention.12 Rippit analyzes 100% of conversations and includes chatbot monitoring.14
Trade-offs: as of October 2026, the trust center we checked doesn’t describe PII redaction in transcripts. Rippit lists its HIPAA evidence as a Type 1 attestation, so ask about scope and timing if health data is in scope.
Best for
buyers who want the longest published certification list.
Choose it when
certification breadth is the deciding factor. See unitQ Support QA vs Rippit.
6IrisAgent: best for redaction before storage with a private deployment
IrisAgent’s security page lists SOC 2 Type II, HIPAA, GDPR, CCPA and PCI DSS, says PII such as names, emails, URLs and Social Security numbers is redacted before storage, and offers IrisAgent Private for on-premise deployment.13 Its AutoQA grades 100% of AI and human conversations.18
Trade-offs: IrisAgent also sells an AI agent that resolves conversations, so it fits best if you’ll buy the agent too.18
Best for
teams that want redaction before storage and a private deployment.
Choose it when
you want the bot, QA and redaction from one vendor.
7Lorikeet: best for teams buying an AI agent and QA together
Lorikeet lists ISO 27001, SOC 2 Type 2, a DPA or BAA (including HIPAA) and data residency options on its pricing page.15 Its Coach product scores human and AI conversations with a single Ticket Quality Score.24 Automated QA is priced at $0.30 per ticket on its Start plan, which is $2,100 a month paid annually.15
Trade-offs: Lorikeet resolves tickets with its own AI agent, so it grades its own work. The page we checked doesn’t describe transcript redaction.
Best for
teams buying an AI agent and QA together.
Choose it when
you want one contract for automation and quality.
Comparison table
| Capability | unitQ | evaluagent | Level AI | Zendesk QA | Rippit | IrisAgent | Lorikeet |
|---|---|---|---|---|---|---|---|
| Yes | Yes | Yes | Yes | Yes | Yes | Yes | |
| Yes | Yes | Yes | Partial | No | Yes | No | |
| Yes | No | Yes | Yes | Partial | Yes | Yes | |
| Yes | No | No | Partial | No | Yes | Partial | |
| Yes | Yes | Yes | Yes | Partial | Yes | Yes | |
| No | No | Yes | Yes | No | Yes | Yes |
All entries reflect each vendor’s public pages as of October 2026. A dash means partial or qualified; a cross means no, or not stated publicly. Open a row for the detail.
See unitQ Support QA
Bring your security questionnaire. See how unitQ Support QA scores conversations with PII removed before storage.
See unitQ Support QAOther tools on security shortlists
- Intercom (Fin): SOC 2 Type II, HIPAA and several ISO certifications, with Monitors for QA across Fin and human conversations.1920 It grades its own AI agent.
- Cresta: its trust page says all PII is automatically redacted and lists ISO/IEC 42001 and PCI DSS.21
- Observe.AI: lists SOC 2 Type 2, ISO 27001, PCI DSS, GDPR and CCPA.22
- ScorebuddyCX: lists ISO 27001:2022 and SOC 2 Type 2.23
FAQ
No. Ask for the full report. SOC 2 examines controls relevant to security, availability, processing integrity, confidentiality or privacy, and vendors choose which criteria their report covers. The AICPA also urges buyers to evaluate SOC services carefully, so check the report’s date, scope and auditor.
It depends on the vendor. unitQ says it removes PII before storage or scoring, Level AI before any AI processing, IrisAgent before storage, and Zendesk describes masking through an add-on. Redaction before processing limits what reaches the model and the vendor’s subprocessors. Ask each vendor which step it redacts at and which fields it catches.
It can work, but you lose an independent check. When one vendor builds the bot and scores it, the same company decides what counts as resolved. An independent QA platform scores the bot on a rubric you own and keeps quality data with a separate vendor. Many teams use both and compare the numbers.
Ask for the current SOC 2 Type II report, the subprocessor list, where data is hosted, how PII is redacted and when, how long transcripts are kept, whether customer data trains any model, and who can see raw conversations. Our feedback vendor security review checklist lists the rest.
When another platform is the better choice
If you need published per-user pricing, evaluagent lists its prices and unitQ doesn’t. If health data is central and you need HITRUST, Level AI is the clearer match. If certification breadth decides it, Rippit lists PCI DSS and ISO 27001. If your whole support stack lives in Zendesk and you don’t run third-party bots, Zendesk QA with its privacy add-on keeps everything in one vendor. unitQ Support QA fits best when you need an independent grader for AI agents you didn’t build, with PII removed before anything is stored.
To go deeper, read what support QA is, what AI agent QA is and how to check support compliance and process adherence.
See it on your own conversations
Bring a sample of your conversations and your security questionnaire. We’ll show you how unitQ Support QA scores them.
Related guides
Sources 25 references
unitQ, “Security.” unitq.com/security/. Accessed October 2026.
unitQ, “unitQ Support QA.” unitq.com/products/unitq-support-qa/. Accessed October 2026.
unitQ, “unitQ Support QA vs Rippit (formerly MaestroQA).” unitq.com/compare/unitq-support-qa-vs-rippit/. Accessed October 2026.
AICPA & CIMA, “System and Organization Controls: SOC suite of services.” aicpa-cima.com. Accessed October 2026.
NIST, “SP 800-122, Guide to protecting the confidentiality of personally identifiable information (PII).” csrc.nist.gov/pubs/sp/800/122/final. Accessed October 2026.
evaluagent, “Pricing.” evaluagent.com/pricing/. Accessed October 2026.
evaluagent, “Auto quality assurance.” evaluagent.com/auto-quality-assurance/. Accessed October 2026.
evaluagent, “AI agent observability.” evaluagent.com/ai-agents/. Accessed October 2026.
Level AI, “Security.” thelevel.ai/security/. Accessed October 2026.
Zendesk, “Quality assurance.” zendesk.com/service/quality-assurance/. Accessed October 2026.
Zendesk, “Trust center.” zendesk.com/trust-center/. Accessed October 2026.
Rippit, “Trust center.” trust.rippit.com. Accessed October 2026.
IrisAgent, “Security.” irisagent.com/security/. Accessed October 2026.
Rippit, “Rippit.” rippit.com. Accessed October 2026.
Lorikeet, “Pricing.” lorikeetcx.ai/pricing. Accessed October 2026.
Level AI, “Quality assurance for contact centers.” thelevel.ai/product/quality-assurance-contact-center/. Accessed October 2026.
Level AI, “Level AI.” thelevel.ai. Accessed October 2026.
IrisAgent, “IrisAgent.” irisagent.com. Accessed October 2026.
Intercom, “Security.” intercom.com/security. Accessed October 2026.
Fin, “Analyze.” fin.ai/analyze. Accessed October 2026.
Cresta, “Trust.” cresta.com/trust/. Accessed October 2026.
Observe.AI, “Security.” observe.ai/security. Accessed October 2026.
ScorebuddyCX, “Security.” scorebuddycx.com/security. Accessed October 2026.
Lorikeet, “Best AI QA tools for support.” lorikeetcx.ai/articles/best-ai-qa-tools-support. Accessed October 2026.
Zendesk, “Pricing.” zendesk.com/pricing/. Accessed October 2026.