Security & trust.
Your phone system holds recordings, transcripts, contacts and card details. This page says where that data lives, who else touches it, and what we do and do not have. We would rather list a gap than imply a certification we have not earned.
How your data is protected.
Hard tenant isolation
Every table holding customer data runs Postgres row-level security in FORCE mode. The only path to a row is a transaction opened for one organization, which means a cross-tenant read is not reachable even from our own application code — not a rule we remember to apply, a rule the database enforces.
Encryption in transit and at rest
TLS on every external connection. The database, and the object storage holding recordings, transcripts and backups, are encrypted at rest by the platforms that host them. Recordings are served through short-lived signed URLs, never a public bucket.
Roles and audit
Three organization roles — owner, admin and member — over roughly 35 granular permissions. An API key belongs to a person rather than to one organization, and reaches whatever that person can reach: tokens are bcrypt-hashed at rest, shown once and never again, optionally set to expire, and revocable at any time, and a leaked key cannot mint another because only a signed-in browser session can create one. Sensitive actions are recorded in an audit log you can read from your own settings — onboarding, text sends, AI agent setup and tests, offboarding, and the admin actions we take on your account for billing, tax and onboarding — with request bodies redacted at write time.
Caller ID and call signing
Outbound caller ID must be a number your organization actually owns, checked on every path that can originate a call. Calls are signed for STIR/SHAKEN at the carrier so they are less likely to arrive as "Spam Likely".
Consent, opt-out and retention
Recording and AI disclosures are played from a locked template and the proof is written to an append-only ledger. A STOP suppresses the number in both the consent ledger and the messaging store, and survives the account it was given to. You set your own retention windows for recordings, transcripts and messages; the purge deletes the stored file before the row.
Backups
The database is dumped nightly, encrypted, to object storage, and a dead-man’s switch pages the founder if no backup newer than 26 hours exists. We monitor backup freshness; we do not run scheduled restore drills, and we will not claim we do.
Where it runs.
The console, the API and the background workers run on Railway, alongside the Postgres database that holds your account, contacts, call records and messages. Recordings, transcripts and nightly database backups live in Cloudflare R2 object storage.
Call control is ours. The software that answers, routes and bridges a call runs on servers we operate at Hetzner, and the audio terminates there — not in a third-party call platform. Telnyx is the carrier of record for numbers, SIP trunking, texting and 911, and does not touch call routing.
All of it is hosted in the United States. We are a Florida company selling to Florida businesses, and we do not currently offer data residency in another region.
Subprocessors
Every vendor that can touch customer data. The AI list is read live from the same internal registry our platform admin maintains, so it cannot drift from what we actually run.
Infrastructure and carrier
| Vendor | What it does |
|---|---|
| Telnyx | Carrier of record — phone numbers, SIP trunking, SMS and MMS delivery, 911 routing, call signing |
| Railway | Hosting for the application, the background workers and the Postgres database |
| Hetzner | Servers running our own call platform, where call audio terminates |
| Cloudflare | R2 object storage for recordings, transcripts and backups; CDN and DDoS protection for the website |
| Stripe | Payment processing and invoicing |
| Resend | Transactional email — invoices, voicemail notifications, alerts |
| Grafana Cloud | Metrics, logs and traces for operating the platform, plus on-call alerting |
Speech and AI
These vendors see call audio, transcripts, or the text of a conversation, and only when you turn on transcription or the AI receptionist. If you never enable either, none of them receive anything.
| Vendor | What it does |
|---|---|
| Anthropic | AI receptionist language model |
| Deepgram | Speech-to-text transcription |
| Google (Gemini) | Real-time AI voice conversation |
| Groq | AI receptionist language model |
| OpenAI | Speech-to-text transcription |
Agreements and certifications.
Business Associate Agreement. If you handle protected health information, there is a real BAA and you accept it yourself during onboarding — no sales call, no waiting on a countersignature. Healthcare accounts stay blocked from going live until every vendor in the chain above is covered, which is a gate we enforce in code rather than a promise.
Call signing and message registration. Outbound calls are signed for STIR/SHAKEN at the carrier. Business texting requires carrier brand and campaign registration, and we do that registration for you before your first text goes out.
What we do not have. No SOC 2 report and no audit under way. No ISO 27001. No separate data processing addendum beyond the terms in our Privacy Policy. If your procurement process needs any of those, tell us before you buy rather than after — we would rather lose the deal than be vague about it.
Our Terms of Service and Privacy Policy are the versions you accept at signup, and we record exactly which version each account agreed to and when.
Found a vulnerability?
We welcome responsible disclosure. Email [email protected] with reproduction steps. We respond within two business days and credit researchers, with permission, on this page.