A phone call contains customer data. Treat it that way.

Tenant isolation

Every business-owned record carries a tenant identifier. Server use cases require an explicit tenant context, while PostgreSQL grants and row-level security provide a second boundary. Automated tests create two tenants and verify that browser roles cannot read or mutate the other tenant’s data.

Provider and webhook security

Voice, telephony and billing providers enter through separate adapters. Webhooks are verified against the raw request, persisted with a unique provider event ID and processed idempotently. Provider credentials stay in server secret stores and never appear in browser code.

Call content and recordings

Recording is designed to remain off by default until consent language and launch-state rules are approved. Enabled recordings are private objects served through short-lived authorized access. Normal logs exclude raw audio and transcript bodies.

Access and audit

Tenant roles separate call review, routing, recording and billing access. Platform administrator accounts require stronger authentication before launch. Sensitive configuration, support access, exports and deletion actions enter an append-only redacted audit trail.

Retention and deletion

Recordings, full transcripts, redacted summaries and financial records have separate retention classes. Scheduled deletion must be operating before recording can launch. Legal holds and accounting requirements are explicit exceptions, not silent permanent retention.

Cost abuse is a security problem

Public demos and trials have call, minute, concurrency and daily-spend ceilings. Tenants receive usage thresholds, overage control and a hard-cap option. A client or caller cannot report its own billable duration.