Security

Built like we're touching your customer data.

Because we are. You're wiring an outside system into your CRM and phone lines across every location. Here is exactly how that access works, what we do with your data, and what we refuse to do with it.

Read the full MSA & DPA → Ask our team
Our security commitment

Six promises, in plain English.

Each one is written into our customer agreement, not just this page.

Your data always belongs to you.

We never sell your data.

We never use your data to train another customer's agent.

Your data is isolated and encrypted, in transit and at rest.

Our integrations use limited-access credentials.

You can revoke our access at any time.

The architecture

How your data is held.

Encryption everywhere

TLS 1.2+ (1.3 preferred) for every byte in transit; encryption at rest for recordings, transcripts, and records.

Per-tenant isolation

Your data lives in its own logical boundary. No shared indexes, no cross-tenant queries, no bleed.

Least-privilege access

Integrations run on scoped service accounts with the minimum permissions the workflow needs, created with you, revocable by you in one click.

MFA & access logging

Internal access to production systems requires MFA and is logged. Humans review your calls only for QA and tuning.

No shared-model training

Your customer data never trains models shared with other customers. Improvements to your agent stay yours.

No data resale. Ever.

We are paid by subscription, not by your data. We do not sell, rent, or broker customer information, contractually.

Commitments in writing

The detail, spelled out.

These live in the Master Services Agreement and Data Processing Addendum, not just on this page.

Who owns the data? +
You do. Call recordings, transcripts, and customer records processed on your behalf are your data. On termination you get a 30-day export window, then deletion on a defined schedule.
What about breach notification? +
We notify you without undue delay and within 72 hours of confirming a breach affecting your data, with the facts we have and the remediation under way.
Which subprocessors touch the data? +
Categories: cloud hosting, telephony carriage, speech-to-text, text-to-speech, language models, and payments. The current list is available on request and changes are notified in advance.
Call recording consent? +
Recording and disclosure rules vary by state. The agent's greeting and disclosure behavior is configured to your jurisdictions during onboarding, and the responsibility split is spelled out in the MSA.
HIPAA? +
Standard plans are not a HIPAA environment and shouldn't carry PHI. HIPAA workflows with signed BAAs are available on Enterprise, raise it on the kickoff call.
SOC 2? +
A SOC 2 Type II audit is in progress. Ask and we'll share current status and timeline honestly rather than a badge that overstates it.

Security questions? Bring them.

One flat monthly fee, every call included, never per-minute, month-to-month. Full MSA & DPA at /terms, subprocessor list on request, security review calls welcome, and custom DPAs & BAAs on Enterprise.

Talk to our team → Hear it live