Legal
Security
Answering phones means handling sensitive information. Here is how we protect it.
Last updated
Our approach
Security is built into how we run the service rather than bolted on. We encrypt data in transit and at rest, limit who can reach it, and keep audit trails of access to production systems.
What we do
Encryption in transit
All traffic to and from the service, including call audio and dashboard sessions, is encrypted with TLS 1.3.
Encryption at rest
Call recordings, transcripts, and account data are encrypted at rest with AES-256.
Access control
Internal access to customer data is restricted on a least-privilege basis, requires multi-factor authentication, and is logged.
Isolation
Customer data is logically separated, and production access is limited to a small number of on-call engineers.
Monitoring
We monitor for unusual activity and maintain alerting on authentication, data access, and infrastructure changes.
Vendor review
Sub-processors such as cloud hosting, telephony, and payments are reviewed before use and bound by data protection terms.
Your responsibilities
- Use strong, unique passwords and enable multi-factor authentication for your team.
- Remove access for team members who leave.
- Configure call recording notices and consent handling for your jurisdiction.
- Set retention rules that match your business and legal requirements.
Incident response
If we become aware of a security incident affecting your data, we will investigate promptly and notify affected customers without undue delay, along with the information needed to meet your own obligations.
Reporting a vulnerability
If you believe you have found a security issue, please email us before disclosing it publicly. We will acknowledge your report, investigate, and keep you updated on the resolution.
Questions
These summaries are provided for clarity and do not replace your right to contact us directly. Email [email protected] or use our contact page with any questions about this policy.