Security
Security, and what is not certified
What we protect, how, and what has no certificate on it yet.
One organization cannot see another
Every model that belongs to a customer carries an organization scope applied globally, at query level. It is not a filter written into one controller and forgotten in another: with no scope bound, the query returns nothing.
On top of that sit per-action policies and tenant resolution before route-model binding. That order matters. With it the other way round, a request for another organization resolved a real record before any policy ran. The bug existed, the tests found it, it was fixed application-wide, and it now has a regression test.
Queued work binds its tenant explicitly. A job running an hour later has no request to inherit one from, and a job with no tenant would run with the scope inert.
| global scope | On every model that belongs to an organization. |
|---|---|
| policies | On every action, not only on read. |
| middleware order | The tenant resolves before route-model binding. |
| queued jobs | Tenant bound explicitly, never inherited. |
Roles, permissions and keys
Ten roles over a catalogue of 71 permissions, from owner down to operator, member and analyst. Roles are scoped to the organization rather than global, so the same person can be an administrator in one and an operator in another.
API keys carry separate read, write and destructive scopes, can be rotated without losing their identity, and are rate limited per key rather than per IP address. Public keys, the ones meant for a browser, are a separate class and cannot do what a private key does.
SCIM provisioning runs on its own token. That is deliberately a different credential class: a token that can suspend people has to be revocable on its own.
| roles | 10, scoped to the organization. |
|---|---|
| permissions | 71 in the catalogue. |
| API keys | Scopes, rotation, rate limit per key. |
| SCIM | Its own token, separately revocable. |
| audit | Who changed what, as records readable in the console. |
What gets written, what gets masked
A call leaves behind events, a transcript, the messages exchanged with the model, latency metrics, costs and, if you turned it on, an audio recording. All of it sits in your organization.
Personal-data redaction applies to transcripts and logs after the call, if the call retention policy asks for it. It recognises card numbers — Luhn-checked, so a 16-digit order reference is not masked for nothing — email addresses, phone numbers, IBANs and national identifiers, the Romanian CNP included.
We say plainly what redaction is not: a transformation on data we already hold. It is not a claim that sensitive data never reached the platform.
| card number | 13 to 19 digits, Luhn-validated before masking. |
|---|---|
| Masked in transcripts and logs. | |
| phone | E.164 and common national forms, on a conservative pattern. |
| IBAN | Masked. |
| national id | Romanian CNP, US SSN, UK NINo. |
| retention | A daily job applies the policy. Recording deletion is on demand; erasing call content has no interface. |
The files can live on your side
Recordings and artefacts are the part most likely to be governed by somebody else's policy, so the destination is configured per organization. The platform bucket is one option out of five rather than the only one.
A driver whose adapter package is not installed does not appear in the interface at all. A backend you can select and cannot use is worse than one that is absent: you would find out at the first recording.
Files are served through short-lived signed URLs. The installation's default region is configurable and starts in the European Union.
| destinations | Platform bucket, S3, Cloudflare R2, Azure Blob, S3-compatible. |
|---|---|
| URLs | Signed, expiring after 15 minutes. |
| region | Configurable per installation, EU by default. |
| transfer | The move into your storage happens after the call, through a queued job. |
What we do not have
We have no SOC 2. No ISO 27001. No HIPAA or PCI attestation. We have not had a third-party penetration test.
SAML single sign-on is not implemented; OAuth and SCIM exist for users, but SCIM Groups does not. The shell and computer tools refuse to run because there is no sandbox for them yet — refusing is the right choice, but it still means the feature is missing.
If you need any of the certifications above in order to sign, we are not it yet.
| SOC 2 / ISO 27001 | Neither. No audit started. |
|---|---|
| HIPAA / PCI | No attestation. |
| penetration test | None by a third-party firm. |
| SAML | Not implemented. Needs an XML signature library. |
| SCIM Groups | Not implemented. Users can be provisioned, groups cannot. |
What security teams ask us
- Are you certified?
- No. No certification, no audit started. If your compliance department requires SOC 2 or ISO 27001, today the answer is no.
- Where does the data sit?
- The installation region is configurable and starts in the European Union. The model, transcription and voice vendors have their own regions, and there the choice is yours through which providers you configure.
- Can we keep recordings ourselves?
- Yes, and it is the recommended path. Add a storage destination on S3, R2, Azure Blob or an S3-compatible store, and the files move there after the call.
- How do we delete a customer data?
- Retention runs daily against the policy set for you, and deleting a recording is an operation you can perform on demand. Erasing the rest of a call — transcript, messages, event payloads — runs through retention or a command rather than through a button, and the API endpoint that deletes a call is a soft delete. The data-rights page states the position for each right.
The questionnaire you are about to send
Most of it is already answered on this page, on the sub-processor list and in the data processing agreement. Send the rest and you will get written answers, including where the answer is that we do not have it.