Built to pass your security review
The controls your compliance team will ask about are standard on every plan, not a bolt-on reserved for enterprise contracts.
Encryption everywhere
TLS 1.3 for signalling, SRTP for media in transit, and AES-256 for recordings and transcripts at rest.
Access control
SSO via SAML and OIDC, SCIM provisioning, and role-based permissions scoped down to an individual queue.
Regional residency
Pin call data and recordings to the EU, UK, US, APAC or Middle East. Chosen at signup, changeable on request.
Audit and retention
Immutable audit logs, configurable retention windows from 30 days, and one-click export for regulators.
The practices behind the certificates
Secure development
Every change goes through peer review and automated dependency scanning. Production access requires hardware-backed MFA and is logged.
Independent testing
We commission an external penetration test annually and after any material architecture change. Summary reports are available under NDA.
Incident response
A documented runbook with a named on-call owner. We notify affected customers of a personal data breach within 72 hours of becoming aware.
Vendor management
Sub-processors are contracted on terms no less protective than our own, and we give 30 days notice before adding one.
Running a security review?
We will complete your questionnaire, countersign a DPA and walk your team through the architecture. Most reviews close in a single call.
Talk to our security teamYour team could be
taking calls by lunch
Tell us how you call today and we will build the flow with you on a 15-minute demo. Numbers activate the moment you say go.
- 12 min
- Median setup
- 118
- Countries
- 4.8/5
- Customer rating