Security
Your recordings are your callers talking. We treat them that way.
This page describes what is actually implemented, what is still being built, and what we do not have. It contains no badges, no certification claims and no audit dates, because we have not earned any of those yet.
Where your data sits and how it is protected.
| Control | Status | Detail |
|---|---|---|
| Encryption in transit | Live | TLS on every connection to the app. No plaintext listener. The REST API and the MCP server terminate on the same edge when they ship. |
| Encryption at rest | Partial | Credentials are encrypted inside the database (row below). We do not claim volume-level or full-disk encryption as a control, because we would rather name the controls we can point at than the ones a hosting provider might supply. If that becomes a control we run, it will be a dated changelog line. |
| Hosting | Live | Self-hosted Postgres that we run ourselves, not a shared multi-tenant analytics vendor. Named infrastructure providers are on the subprocessor list. |
| Credentials vault | Live | Ringba API keys and OAuth tokens are encrypted in the database with a passphrase held in the environment, never in the table beside them. Every credential row is scoped to one workspace. |
| Password hashing | Live | argon2id, with automatic rehash when parameters are raised. We cannot read your password and cannot email it back to you. |
| CSRF protection | Live | Session-bound token on every authenticated state-changing request, paired with a SameSite session cookie. |
| Transcript PII redaction | planned | Not shipped. Today a transcript contains whatever the caller said, including anything they volunteered. Treat it accordingly until the changelog says otherwise. |
Status is stated per control on purpose. Anything not marked live is not running in production today.
A workspace can only reach its own data.
- Default-deny tenancyIsolation is not a filter applied by each feature. Every read and write to customer data goes through a single choke point that constrains it to the requesting workspace, and a route is denied unless it has been explicitly opened. Code that touches a tenant-owned table outside that path is treated as a data-isolation bug, not a style preference.
- RolesOwner, admin, member and viewer. Viewers read. Members work. Admins manage the workspace. Only an owner can transfer or delete it.
- Agency workspacesOn the Agency plan each client sits in its own workspace with its own keys, and one client workspace cannot see another. Read-only client share links are planned and are not running yet.
- API keysin build Scoped to a workspace, revocable, stored as a hash, and compared in constant time. The key store is built and managed from settings, and stays inert until the public API ships.
- MCP is read-onlyplanned The MCP server will answer questions about your data and will have no write path. We are stating that constraint before it ships so you can hold us to it — it is a design decision, not a permission you will be able to grant.
- Invitations expireInvite tokens are stored hashed, bound to an email and a role, and time-limited.
We never train models on your calls.
Not on any tier. Not for a shared benchmark, not for a model of our own, not through a setting that defaults to on. Your recordings and transcripts are processed to produce your labels and then they are yours. This commitment is in the footer of every page on this site and it is written into the DPA, which is where it actually binds us.
Transcription and labelling use third-party model providers. They are named on the subprocessor list along with what each one receives. If that list changes, the change is dated in the changelog.
Why this is stated so bluntly
A call recording is a third party talking, usually about a problem in their house or their health or their accident. They did not consent to becoming training data for a vendor two steps removed from the business they called. Neither did you.
Getting your data out, and getting it deleted.
- Full export, every tierCSV of calls, labels and aggregates. No support ticket, no gate, no downgrade penalty. It is on the cheapest plan for the same reason it is on the most expensive one.
- Deletion on requestAsk and we delete the workspace, its calls, its transcripts and its labels, then confirm when it is done. Backups age out on their own rotation, which is the honest caveat every provider has and most do not print.
- Configurable retention windowin build Per-workspace retention with automatic expiry of transcripts and recordings past the window. Until it ships, retention is on request.
Our source of truth is your call platform. We read from it. If you leave, or if we disappear, what you lose is our analysis, not your calls. That is deliberate, and it is the honest answer to the question every operator asks about a company this new.
What we do not have.
No SOC 2 report
We do not hold a SOC 2 Type I or Type II report, we have no auditor to name, and we will not display a badge suggesting otherwise. We are also not going to say a report is in progress in order to imply a date. If your procurement process requires the report to start a trial, we fail that review today. That is a real answer and you can plan around it.
When that changes it will be a dated line in the changelog with the report available under NDA, not a graphic in the footer.
- What we offer insteadNamed subprocessors, a DPA you can read before you sign up rather than after, published retention and deletion behaviour, full export with no gate, and a dated public changelog.
- DPA before signupRead it first. Data processing agreement.
- SubprocessorsWho touches your data and what each one receives. Subprocessor list.
Your recordings, your legal obligation.
You decide which calls are recorded, in which states, with what disclosure at the top of the call. We process what your call platform already holds. That means consent is configured upstream of us, and it stays your responsibility.
The parts worth checking with your own counsel: two-party consent states, where every participant must be notified before recording begins; the disclosure your IVR or agent actually plays, and whether it survives a transfer through a ring tree; and the TCPA exposure adjacent to any outbound follow-up on a call you sourced. None of that is legal advice and we are not qualified to give it.
What we do to help
- Per-workspace scopeChoose which campaigns are connected, so recordings you would rather not process never arrive.
- Deletion of specific callsRemove an individual call, its recording reference and its transcript, on request.
- Guidance, not a legal opinionAsk on the security route and we will tell you what we do with a recording and where it goes. Whether you may record it is a question for your lawyer.