Security Practices

1. Our approach

We design and operate the safeguards set out in our Information Security Policy around the three internationally recognized principles of information security: confidentiality, integrity, and availability.

2. Access control

• Every feature and API requires user authentication, and permissions are granted at the minimum level needed for each role (administrator, member, etc.) under the principle of least privilege. Administrative operations such as adding users, changing permissions, and deleting accounts are restricted to administrators.
• Each customer's (tenant's) data is logically isolated so that no customer can access another customer's data. All reads and writes are always scoped to the individual customer.
• Access can additionally be limited by department: non-administrator users can only view call history belonging to their own department.
• Privileged operations on our side are restricted to designated personnel, and no privileged role is ever granted through the normal user sign-up flow.

3. Logging

• We keep audit logs recording who did what and when. They cover important operations including logins (successful and failed), changes to users and settings, viewing call history and playing recordings, and plan changes.
• Customer administrators can review audit logs in the admin console.
• System access and operational logs are centrally managed on our cloud platform and kept available for investigating incidents and unauthorized access.

4. Backups and data retention

• The database is operated with automatic backups provided as a managed feature of our cloud provider. Files such as uploaded documents are stored in highly durable object storage.
• Call history data that is older than the retention period selected by the customer in the management console (30 to 180 days; 180 days by default) is no longer displayed, and the transcripts, recordings, summaries, and other parties' phone numbers of those calls are deleted by periodic processing. Deleted data cannot be restored. Records required for billing (call date, time, and duration) are retained (unless otherwise agreed in an individual contract).
• Credit card information is never stored in our systems (see §6).

5. Disaster recovery

• The service runs on a redundant managed cloud platform, and releases are performed as zero-downtime rolling deployments. Changes are kept backward compatible, and we can roll back to a previous version if a problem occurs.
• Daily automated jobs such as aggregation and deletion detect failures and send notifications so that operations staff can respond to anomalies.
• Our response to outages and security incidents (assessing impact, containing spread, recovery, preventing recurrence, and notifying customers) follows the procedures set out in section 5, "Incident response", of our Information Security Policy.

6. Data encryption

• All communication with customers' browsers, the telephony platform, and external services is encrypted with TLS.
• Stored data is protected by the encryption-at-rest capabilities provided by our cloud provider.
• Passwords are stored only as irreversible hashes and never in plain text. Password reset tokens and verification codes are protected in the same way.
• Credit card information is not held in our systems; payment processing is entrusted to a PCI DSS-compliant payment processor.
• Notifications (webhooks) from the telephony platform and the payment processor are processed only after verifying their signatures to confirm the sender's authenticity.

7. Availability

• The application is designed to run as multiple concurrent instances, localizing the impact of load spikes and failures.
• API request rate limits mitigate the impact of excessive access.
• We provide safeguards that protect customers from unexpected usage, such as budget cap alerts on usage fees and inbound call guards against nuisance and prank calls.
• We monitor service health, and operations staff are notified when anomalies are detected.

8. Certifications and third-party assessments

To continuously verify and improve our security through objective third-party evaluation, we plan to obtain the following certifications and assessments. We will update this page as their status changes.

* The table above includes future plans. We hold no certifications at this time.

9. Security questionnaires

We respond individually to information security questionnaires (security checklists) required for procurement and business transactions, as well as to questions about matters not covered on this page. Please reach out via Contact.