Company and compliance
Security and data
How call data is handled, for your IT, security and procurement teams.
What's kept
| Data | Why | Kept for |
|---|---|---|
| Lead details | To call the lead and pass details to your team | Until you delete them |
| Transcripts and summaries | So your team can see what happened | Until you delete them |
| Call recordings (if on) | Quality and training | Your retention period (default 90 days) |
| Meetings booked | So your staff can run the meeting | Until you delete them |
| Do-not-call list | So opted-out people are never called again | Indefinitely |
| Staff accounts | To sign in | While they're on your team |
Call audio is turned into text as it happens and isn't stored unless recording is on.
Where it goes
| Service | Receives | For |
|---|---|---|
| Twilio | Call audio, phone numbers, recordings | Calls and texts |
| Deepgram | Caller audio | Speech to text |
| Fish Audio | The agent's words | The agent's voice |
| Google Gemini / Anthropic Claude | Transcript, lead details, your playbook | What the agent says; summaries |
| Your connected apps | Calls, meetings, answers | Your own systems, only those you connect |
Controls
- The app and its database run in Sydney; the database is encrypted at rest.
- Every page and API request checks you belong to the company that owns the data.
- Passwords are hashed; sessions are signed, HTTP-only cookies sent only over HTTPS.
- Every request from Twilio is checked against its signature, and each call's audio stream needs a one-off secret.
- App tokens and keys are encrypted (AES-256-GCM); disconnecting an app deletes them.
- API keys are stored only as a fingerprint.
- All connections use TLS.
Accounts
- Two-step sign-in with an authenticator app, which admins can require for the whole workspace.
- Passwords of at least 10 characters, hashed with bcrypt. Changing or resetting one signs out every other device.
- Repeated wrong passwords or codes lock sign-in for that account and address for a while.
- An activity log of sign-ins and changes, for admins.
- Workspaces keep each client's people and data apart.
Protection
- Rate limits on sign-in, sign-up, password resets, invites, API keys and lead webhooks.
- Security headers stop the app being framed by other sites and limit what pages can load.
- Webhook secrets are compared in constant time and can be sent in a header instead of the address.
Not yet in place
Single sign-on (SAML/OIDC), self-service data export and deletion, and per-workspace data residency settings.