Security & privacy
Your customer's number never sits in plain view.
A phone agent works with personal data. So we designed phone numbers, credentials and support access around data minimisation. Below is what we do, and what we don't claim.
Phone numbers
Encrypted at rest
Phone numbers are stored encrypted in the database with Fernet.
Keyed matching
To recognise a caller, the number is never looked up in plain text; it is matched with a keyed HMAC.
Masked by default
Numbers are masked by default in the console, call history, logs and reports (like +90 555 *** ** 47). Exports and the API return full numbers only if your company switches that on.
Tenant isolation and access
Isolation in the database
Each store's data is separated not only in application code but in the database, with Postgres row-level security (RLS).
Read-only support access
When our team supports you, access to your account is read-only by default. Write access is time-boxed, needs a stated reason and is recorded.
Change history
Every change, from assistant settings to integrations, is recorded with who made it and when.
Credentials and language models
Write-only credentials
Store API keys, SIP passwords and SMS provider credentials are stored encrypted and never shown again in the console after saving.
Masked transcripts for analysis
For post-call analysis (topics, quality, insights), phone numbers, emails, addresses and long numbers are masked before a transcript goes to a language model. During a live call, the agent processes what the customer says so it can do the job.
SMS off by default
Order-link and confirmation texts are off by default for every store; you switch them on.
Consent on outbound calls
İYS consent check
Before a commercial outbound call, consent is checked with the consent provider your company configures (your İYS integrator or your own HTTP endpoint); with no consent or no answer, the number is not dialled. The check is configured per call purpose.
Do-not-call list
Numbers that don't want to be called are kept hashed and checked before dialing.
Hours, repeats and quotas
Calling hours, a guard against calling the same person again and quotas are applied before dialing.
What we don't claim
- We don't claim any security certification (such as ISO 27001 or SOC 2).
- Speech recognition, the language model and speech synthesis are processed at US-based providers (OpenAI, ElevenLabs; optionally Deepgram, Anthropic). We share the legal basis for this cross-border transfer during contracting.
- We share data-processing details during the sales process.
- We answer your security questions or your own assessment checklist in the demo or by email.
This website
This site has no tracking cookies, ad pixels or analytics scripts. What you write in the demo form is used to contact you and, if you agree, for product news.
For a security question or report, write to [email protected]
Hear it on a call with your own store's data.
In thirty minutes we walk through the console, place a live call and work out which of your calls the agent can take.
or write to [email protected]