Security

The strongest control here is an absence: we do not retain call audio. Only the transcript is stored. A recording of someone's voice is far more sensitive and far more damaging if exposed, and not having it removes that risk entirely rather than mitigating it.

• Every table is isolated per business at the database level, enforced by the database rather than by application code.
• A business that does not exist and a business you cannot access are indistinguishable from the outside, so account identifiers cannot be probed.
• Console access requires authentication through a managed provider. We never store passwords ourselves.
• The public enquiry form can write but cannot read: there is no path from the website to reading stored data.

All web traffic is served over HTTPS. Call media travels over encrypted real-time transport. Data at rest is encrypted by our database provider.

If we become aware of a breach affecting personal data we will investigate immediately, notify affected businesses without undue delay, and notify the relevant authority within the deadline that applies — 72 hours under the GDPR, and as required under India's DPDP framework.

We would rather list this than imply a maturity we do not have:

• Automatic deletion of expired transcripts is being implemented; retention is currently managed manually.
• We do not yet hold an ISO 27001 or SOC 2 certification.
• Penetration testing has not yet been carried out by a third party.