Trust
Security Practices
How we protect the systems and data involved in handling your calls, what we ask of you, and what we will not claim without evidence to support it.
How we describe security
Security pages are often written to reassure rather than to inform. This one describes the practices we operate and the questions you should put to us, so your own assessment rests on specifics rather than adjectives.
Where we hold a certification or independent assessment, it will be named here with a document you can request. Where none is listed, none should be assumed. We would rather publish a shorter page than an impressive one.
Current certifications and independent assessments: none currently held. Evidence available on request: documentation of our data handling practices and the supplier chain forming part of your deployment.
Practices we operate
Individual accounts
Staff and client users hold individual accounts rather than shared logins, so activity can be attributed and access removed cleanly when a person leaves.
Least privilege
Internal access to client data is limited to those who need it to operate or support the service, and the list is reviewed rather than left to accumulate.
Credential management
Integration credentials are held under business accounts rather than personal ones, and renewal is tracked so connections do not fail silently.
Data minimisation
We advise against capturing identification numbers, clinical detail or payment details in an automated call, and we design flows that do not ask for them.
Supplier management
We maintain a list of suppliers forming part of the data path, tell you who they are, and notify you of material changes to that list.
Incident handling
We maintain an incident process covering containment, assessment and notification, and we will inform you without undue delay where your data is affected.
Shared responsibility
A great many security problems in call handling originate on the client side, not the supplier side. These are the areas where your own practices matter most.
| Area | What we do | What you do |
|---|---|---|
| Account access | Provide individual accounts and role-based permissions | Grant access narrowly, review it, and remove it when people leave |
| Notifications | Send only the fields you configure | Decide how much detail alerts carry, and where they are sent |
| Exports | Provide export in the agreed format | Control who can export, and where those files are stored |
| Integrations | Request the narrowest access that supports the workflow | Approve permissions, and use a business account for authentication |
| Retention | Apply the periods you set | Choose periods, and apply the same discipline in your own systems |
| Incidents | Notify you without undue delay | Maintain your own response plan and named incident lead |
Our guidance on access control for call data covers the client-side practices in detail, including the gaps that open quietly over time.
Reporting a security concern
If you believe you have found a vulnerability in our service, or you suspect an incident involving your data, contact us through our contact page, marking your message for the attention of the security team. Please include what you observed, when, and how to reproduce it if applicable.
- We will acknowledge your report and tell you who is handling it
- We will investigate and keep you informed of material developments
- We will not pursue action against good-faith researchers who report responsibly and avoid accessing or altering other people’s data
- Where your data is affected, we will notify you without undue delay
Security incidents raised on a call always reach a person. If a caller reports a threat, an incident or a matter involving someone’s safety, the automated flow hands over immediately rather than attempting to log it. That boundary applies in every deployment.
Frequently asked questions
Are you certified to a recognised security standard?
Our current position is stated above. If nothing is listed there, we hold no certification we can evidence, and we will say so plainly rather than implying otherwise.
Can we run our own security assessment?
Ask, and we will tell you what we can accommodate, including questionnaires and any testing arrangements that would need to be agreed in advance.
Who at your company can listen to our calls?
Access is limited to staff who need it to operate or support the service. Ask for the specifics of the roles involved and we will provide them in writing.
What suppliers are in the chain?
We will give you the current list and notify you of material changes. It is a standard item in vendor due diligence.
How quickly would we hear about an incident?
Without undue delay, so you can assess and, where required, notify within your own deadlines. Preparing for that is covered in incident response for call data.
Do you use our call data to train models?
Our position is stated in writing in how we handle your data, including how to decline where that applies.
This page was last updated on 27 July 2026.
Related pages
Send us your security questionnaire
We will complete it honestly, including the rows where the answer is that we do not offer something. That is more useful to you than a page of assurances.