Security and data protection

Infrastructure and data location

• The web application and its PostgreSQL database run on Railway in the United States.
• Calls are routed and forwarded by Twilio. Recordings, when enabled, are stored by Twilio.
• Traffic passes through Cloudflare, which provides TLS termination, DNS and DDoS protection.
• Every third party that processes customer data is listed with its purpose and location on the subprocessors page.

Encryption

• All traffic is served over HTTPS, with HTTP Strict Transport Security (HSTS) enabled.
• Credentials you store with us — CRM OAuth tokens, ad platform credentials and your own AI provider API keys — are encrypted in the application with AES-256-GCM before they are written to the database.
• Passwords are hashed with bcrypt; we never store them in plain text.

Sign-in and sessions

• Sign in with Google, a one-time email link, or a password (at least 8 characters with upper-case, lower-case and a number).
• Password logins are limited to 10 attempts per account per 15 minutes.
• New accounts require a business email address — for email links and Google sign-in alike; disposable and personal email domains are rejected. People invited to an existing workspace may use any address.
• Sessions expire after 7 days.
• Two-factor authentication and SSO/SAML are not available.

Access control

• Each workspace has roles — Owner, Admin, Member and Viewer — with separate permissions for placements, call visibility, team, billing and integrations.
• Administrative actions are written to an audit log with the user, time, IP address and user agent.
• Webhook and integration requests to customer-supplied URLs are checked so they cannot reach private or internal network addresses.
• The application sends a Content Security Policy and standard security headers on every response.

Call recording and AI processing

• Call recording and transcription are off by default and are enabled per placement.
• When enabled, transcription uses OpenAI's speech-to-text API, and AI call analysis (summary, sentiment, lead score) uses Google Gemini.
• The SmartResponse AI voice agent uses ElevenLabs, and the website chat widget uses Anthropic Claude.
• You can supply your own API keys for these AI providers in Settings → API Keys.
• Recording laws differ by country; you are responsible for informing callers where the law requires it.

Your data rights (GDPR)

• Export your data at any time from Settings → Privacy.
• Delete your account and its data from Settings → Privacy. Deletion is permanent.
• Call data is kept while your account is active. Configurable retention periods are not available yet.
• A data processing agreement (DPA) is available for customers who need one.

Security questionnaires and vulnerability reports

Send security questionnaires to [email protected]. Report vulnerabilities to [email protected] (also published in our security.txt).

Related documents

• Subprocessors
• Data processing agreement
• Privacy policy
• Where is my data stored?