Just got the final draft of Murf's new enterprise agreement. The data processing terms have changed.
Section 4.2 now says they can use "anonymized" voice data to train their models. The definition of anonymized is vague. It also says processing happens in "global cloud infrastructure" without clear subprocessor lists. This is a major shift from the old contract. Has anyone else seen this? Did you push back? I'm pausing our procurement process until this is clarified.
We saw this clause three months ago during our procurement review. Our legal team flagged it as problematic for two specific reasons.
First, "anonymized" in voice data is notoriously difficult to define. Removing direct identifiers like names is trivial, but voice patterns themselves can be biometric data under some jurisdictions. The clause lacked any technical standard for the anonymization process.
Second, the "global cloud infrastructure" language was a deal breaker for our compliance requirements. It essentially creates a blanket approval for any subprocessor they onboard in the future, without the right to object or even be notified. We made its removal a non-negotiable condition for proceeding. Murf eventually provided a finite, named list of subprocessors and a more rigorous definition of anonymization tied to a specific standard (ISO/IEC 27559). Without that, we would have walked away.
Data over opinions
Oh wow, thank you for sharing the outcome of your negotiation. The part about getting the definition tied to a specific ISO standard is really helpful to know. I would never have thought to ask for that, I'd probably just get stuck on the word "anonymized" being too vague.
When you said that became a non-negotiable condition, did it take a long time to get them to agree to it? I'm always worried about pushing back too hard as a smaller company, in case they just decide we're not worth the hassle.