AI Connector (MCP) Services Addendum

This AI Connector Services Addendum (the “Addendum”) supplements the Phoneware Terms & Conditions (the “Terms”) between your business (“you” or “Customer”) and Phoneware, Inc. (“Phoneware,” “we,” or “us”). This Addendum governs your access to and use of the Phoneware AI Connector endpoint and Model Context Protocol (MCP) services. By enabling, configuring, or authorizing the use of the AI Connector, you agree to this Addendum. If you do not agree, do not enable or use the AI Connector.

1. Service description & purpose

Phoneware provides an AI Connector accessible via the Model Context Protocol at https://mcp.phoneware.us/mcp. The connector acts as a protocol bridge, allowing authorized users to connect third-party artificial intelligence assistants and applications (such as Anthropic Claude or OpenAI ChatGPT) to Customer’s Phoneware Edge phone system.

Tools available today cover Customer’s cloud phone system, call queues, and AI voice agents. Cloud fax and billing tools will become available once Phoneware enables them for Customer’s account.

2. Eligibility & seat management

The AI Connector is available to active Phoneware business customers. Every user type on Phoneware Edge can turn access on within their own scope:

• Basic users: May self-enroll only for their own extension with read-only access to their own individual call history, voicemail summaries, messages, and answer rules. Basic users cannot grant themselves write capabilities and cannot view or modify data for any other extension.
• Call center supervisors: May access queue statistics, agent availability, wait times, and callback metrics for their assigned call center, in addition to their own extension data.
• Office managers: May access domain-wide analytics, manage user seats, grant write capabilities, configure domain-wide privacy controls, and perform account-level administrative actions.
• Resellers & staff: May access the specific customer domains they already administer in the portal.

Write capabilities (such as updating forwarding rules, modifying answer rules, changing queue status, or sending messages) must be granted by an Office Manager or administrator.

3. Customer-selected AI providers & data transfer

The AI Connector interfaces with third-party AI assistants, platforms, and clients selected and configured directly by Customer or its users (“AI Providers”). When an authorized user submits a query through an AI Provider, the connector transmits relevant phone system data to that AI Provider to generate the response.

Customer acknowledges and agrees that:

• Phoneware does not operate, control, or warrant the third-party AI Provider.
• All data transmitted to an AI Provider is subject to Customer’s own agreement, terms of service, and privacy policies with that AI Provider, including policies governing data retention, training on customer data, and security.
• Customer is solely responsible for vetting its chosen AI Providers, evaluating their data handling practices, and ensuring that transmitting communications data to those providers complies with Customer’s legal, regulatory, and contractual obligations.
• Phoneware is not liable for any acts, omissions, data disclosures, breaches, hallucinations, or errors committed by third-party AI Providers.

4. Recorded-content policy & office manager attestation

To protect privacy, the AI Connector enforces four domain-wide recorded-content access tiers:

• Blocked (Default): The AI assistant receives call metadata only (caller and recipient details, timestamps, and duration). Call recordings, transcripts, voicemail, text message bodies, AI call summaries, and fax page contents are withheld, and the assistant informs the user that content was withheld under Customer’s setting.
• Metadata: As Blocked, and the AI assistant is also told which records carry recorded content and of what kind. The words themselves are withheld.
• Redacted: Transcripts and text content are scanned and scrubbed through automated data-loss prevention algorithms before transmission to the AI Provider, as detailed in Section 5.
• Full: Complete text transcripts and message bodies are provided to the AI Provider without redaction.

Audio is never handed to an AI assistant under any setting. Recording audio files and voicemail audio links are bearer URLs that remain strictly withheld across every tier; only text transcripts may be transmitted subject to the selected policy tier.

All customer domains default to the Blocked setting. Only Customer’s designated Office Manager has authority to raise the recorded-content tier above Blocked. Before raising the tier to Metadata, Redacted or Full, the Office Manager must submit an affirmative electronic attestation through the Manager Portal confirming authorization to share recorded communications with Customer’s third-party AI Providers. Resellers and Phoneware support staff may lower the tier, but can never raise it.

5. Automated masking limitations

When Customer selects the Redacted tier, Phoneware employs automated pattern matching and Google Cloud Sensitive Data Protection (DLP) to detect and redact sensitive personal identifiers, including names, telephone numbers, email addresses, physical street addresses, Social Security numbers, payment card numbers, driver’s license numbers, birthdates, banking credentials, National Provider Identifiers (NPI), and medical record numbers.

Automated masking is algorithmic and can miss sensitive details. Customer expressly acknowledges that automated redaction cannot guarantee 100% detection or removal of confidential information, trade secrets, or personal data. Variations in speech transcription, acoustic noise, non-standard phrasing, colloquialisms, and image quality in faxes can cause identifiers to bypass filters. Customer assumes all risk associated with reliance on automated redaction.

6. Protected Health Information (PHI) & HIPAA

If Customer is a Covered Entity or Business Associate subject to the Health Insurance Portability and Accountability Act (“HIPAA”), Customer represents, warrants, and covenants that it will not transmit Protected Health Information (“PHI”) through the AI Connector, nor configure the recorded-content tier to Redacted or Full for extensions or queues handling PHI, unless Customer has executed an appropriate Business Associate Agreement (“BAA”) directly with its chosen third-party AI Provider covering such data transmissions.

Phoneware’s underlying telecommunications service complies with applicable carrier privacy standards, but Phoneware does not make HIPAA compliance representations on behalf of third-party AI Providers or their model processing environments.

7. Customer Proprietary Network Information (CPNI)

Call detail records, call durations, calling patterns, and destination numbers constitute Customer Proprietary Network Information (“CPNI”) under federal telecommunications regulations. Phoneware protects CPNI through seat-gated authentication requiring each user to sign in with their own Manager Portal credentials, including multi-factor authentication (MFA) wherever MFA is enabled on the user’s portal account.

Users who forget their credentials must use the secure portal password reset page. Customer is responsible for maintaining strict password hygiene, enforcing MFA, ensuring users do not share login credentials, and immediately revoking connector seats for departing employees or compromised accounts.

8. Audit logging & compliance retention

To ensure accountability and regulatory compliance, Phoneware logs all AI Connector transactions. Audit records capture:

• Timestamp, unique event identifier, and transaction duration.
• Authenticated user identity, extension, domain, and role.
• Third-party AI client identifier and application metadata.
• Requested tool and hashed parameters (sensitive argument contents are not stored in audit logs).
• Applied policy tier, withheld flags, and redaction profile applied.
• Record identifiers returned and transaction outcome.

Audit records are kept in cloud storage under a retention policy of six (6) years (2,190 days). Customer’s authorized Office Manager may review and export domain audit records in standard formats through the Manager Portal.

9. Two-phase write confirmations & revocation

To prevent unintended modifications, the AI Connector enforces a two-phase confirmation protocol using confirm_action for all operations that modify data, routing, or system status:

• The connector generates a non-executing preview specifying the exact changes and affected records, held in a pending state for ten (10) minutes.
• The action executes only after the user reviews the preview and explicitly invokes confirm_action through their AI client. Expired or unconfirmed actions are automatically discarded.

Customer may revoke individual user seats or disable the AI Connector domain-wide at any time in the Manager Portal. Revocation takes effect immediately on the subsequent request; access does not persist until token expiration.

10. Availability & warranty disclaimer

The AI Connector is provided on an “as is” and “as available” basis. Phoneware does not warrant that connector operation will be uninterrupted, error-free, or compatible with future versions of third-party AI platforms. Phoneware disclaims all warranties, express or implied, including merchantability, fitness for a particular purpose, and non-infringement, to the maximum extent permitted by law.

11. Free of charge

The AI Connector is provided by Phoneware at no additional service charge for active Phoneware customers. Any subscription fees, API fees, or usage costs charged by third-party AI Providers are Customer’s sole responsibility. Phoneware reserves the right to introduce optional advanced features or modify service tiers upon notice pursuant to the Terms.

12. Changes to this Addendum

Phoneware may update this Addendum from time to time. When changes are made, we will post the revised Addendum with an updated version date. Continued use of the AI Connector after the posting of changes constitutes acceptance of the updated Addendum.

13. Governing law & conflict

This Addendum is governed by the laws of the State of Arizona, without regard to conflict-of-laws principles, and is subject to the exclusive jurisdiction of the state and federal courts located in Maricopa County, Arizona. In the event of a direct conflict between the terms of this Addendum and the general Phoneware Terms & Conditions regarding the AI Connector, this Addendum controls.

14. Contact

Questions regarding this Addendum or privacy practices should be directed to email us or by calling 602·445·7777.