Contact centers carry recordings, card numbers and health details. This page documents how the platform is built, how each tenant is isolated from every other, and what has been measured under failure — including the things that have not been done.
Structural rather than a filter someone has to remember to apply.
Who can get in, what they can reach, and what is readable along the way.
SIP over TLS with SRTP for desktop softphones, and DTLS-SRTP for browser agents. The media key rides inside the encrypted channel, never in the clear.
Carrier, identity-provider, webhook and channel credentials are encrypted with AES-256-GCM. They are never returned by the API — the console only ever sees whether one is set.
Google, Microsoft, generic OIDC and SAML 2.0, with SCIM provisioning and deprovisioning, optional TOTP, and an account policy that can require SSO outright.
Sixteen granular permissions, custom roles, and supervisors scoped to a team branch or specific queues. Per-account IP allow-lists and scoped API keys.
Rate limiting on sign-in at both the instance and cluster level, escalating into a shared ban list at the network edge.
Every configuration change is recorded with who made it, from where, and when — readable in the console and exportable.
Bulk data at rest — the database and stored recordings — relies on infrastructure-level encryption. Application-level envelope encryption with a key management service is designed but not built. No external penetration test has been performed yet.
The obligations that come with recording conversations, and the tooling that meets them.
Export everything held about a phone number, or erase it — recordings, transcripts, callbacks and contacts deleted, records anonymised. A test asserts the erase covers every store that holds personal data.
A per-queue announcement so callers are told before they are recorded, for two-party-consent jurisdictions.
Recording pauses on demand so card numbers are never captured, and card numbers, SSNs and long account numbers are redacted from stored transcripts.
A do-not-call list, calling-window enforcement, quiet hours and a per-contact consent flag that campaigns respect.
Dialling 911 needs no prefix, notifies whoever you nominate, and each agent carries a dispatchable location. Requires a paid plan and E911 registration with your carrier before you rely on it.
Recordings and transcripts age out on a schedule you set, enforced by a worker rather than by policy alone.
Measured on real infrastructure. Where a claim would need hardware we do not have, it is listed as untested rather than implied.
| What was tested | Result |
|---|---|
| Load soak, three hours | 549,000 calls, zero failures |
| Concurrent voice capacity | 1,600 simultaneous calls on the production box |
| Concurrent chat capacity | 1,000 simultaneous conversations, retested clean |
| Killing a server mid-conversation | Agents re-attached to the survivor; customers resumed; no message lost |
| Database failover | Promoted a replica and the platform continued |
| Losing the live-state store | Sentinel promoted a replica; in-flight routing recovered |
| Restoring from backup | Rehearsed end to end, not just scheduled |
| A live call surviving its own server dying | Not supported. The call drops. Documented rather than implied. |
There is no uptime guarantee, and we do not describe the platform as highly available. Both would be claims we cannot currently stand behind.
Every third party involved in delivering the service, and what each one is used for. A data-processing agreement is available on request.
| Sub-processor | Purpose | Data involved | Region |
|---|---|---|---|
| Hetzner | Application and voice hosting | All platform data at rest and in process | Germany (EU) |
| Telnyx | Carrier — inbound and outbound calls, SMS | Phone numbers, call metadata, call audio in transit | US / global |
| Cloudflare | Object storage and CDN | Recordings, transcripts, uploaded files and attachments | Cloudflare network |
| OpenAI | AI agents, transcription, summaries, quality scoring | Conversation audio and text, with card and SSN patterns masked before sending | US |
| SendGrid | Email channel delivery and platform notifications | Email addresses and message contents | US |
| Stripe | Subscription billing | Billing contact and payment details — card numbers never reach us | US |
Bringing your own carrier removes Telnyx from this list for voice and SMS. We will give notice before adding a sub-processor that handles customer data.
Listed here rather than left for you to discover during an evaluation.
We would rather answer it properly than have you find the answer later.
Google or Microsoft · 30-day free trial · no card required