Data policy

The data is yours

Your calls, numbers and staff list remain yours.

Everything in your account — call records, extensions, IVR menus, voicemail, campaign lists — belongs to you. We are its custodian, not its owner.

We do not use your data in a product, do not train models on it, and never expose it to another customer in any form.

How companies are kept apart

The separation is in the database, not in the application code.

Every row records which company it belongs to, and the database itself enforces that boundary on every query. A mistaken query in the application cannot return another company’s rows.

It is the most important technical decision in the system, because the worst accident a multi-tenant service can have is showing one customer another customer’s data.

Getting your data out

Call history can be exported whenever you like.

Call history can be downloaded as a file from the panel at any time, at no extra charge, on every plan including the free one.

For a full copy of everything else on the account, write to us — it usually takes up to 30 days.

Backups

There are backups, and they are encrypted too.

The database is backed up regularly and the backups are encrypted, so that failed hardware or an accidental deletion can be recovered from.

When you ask for data to be deleted it goes from the live system immediately, and from backups as those backups expire. In between, the backups are usable only for disaster recovery.

Who helps us run it

As few providers as the service needs, and the list is public.

Running the platform requires outside providers for hosting, for taking payments, and for sending email. Payments are handled by Stripe, which is also where card details are entered and held.

Each provider receives only what that particular job requires. This page is updated when a provider is added or changed.

Your trunk is your carrier’s business

They hold records of your calls as well, under their own policy.

Calls travel over your own SIP trunk, so your carrier produces its own records of them. Those records are governed by their policy, not ours, and asking us to delete them achieves nothing.

Your trunk password is stored as a digest rather than as a password, which means it is used to authenticate your trunk and cannot be read back out — not by you, and not by us.

A locked account is not a deleted one

Letting a subscription lapse never deletes anything by itself.

When a subscription ends the account locks and stops making calls. The data stays exactly as it was, and resubscribing restores the account rather than rebuilding it.

An account left locked is kept for 12 months, and we write to the address on it before anything is removed. Nothing is deleted for non-payment without that warning.

When you close the account

You get time to take your data, and then it goes.

After you close an account you have 30 days to export what you want. After that, call history and configuration enter the deletion process.

Billing and tax records are held for the period the law sets, and cannot be deleted earlier even on request.

If something goes wrong

A breach gets told to you, not buried.

If an incident puts your data at risk, the affected accounts are told what happened, what information was involved and what was done about it. Getting it right matters more than being first to make a statement, but delay is not an excuse.