Security and data
Your customers' data is the part we are most careful with.
You are about to let a system talk to your customers on your behalf. That is a serious thing to hand over, so here is exactly how it is handled, including the parts that are not perfect yet.
How your customers' data is handled
Phone numbers are hashed in our systems
Conversation history and logs are keyed on a one-way hash of the number. An exposed log contains nothing anyone could ring. The number itself lives with the telephony carrier that delivers the message, because a text cannot be sent to a hash.
Conversations are kept only as long as they are useful
SMS conversation history expires six hours after the last message. Longer-term logs exist so we can find and fix mistakes, and they are hashed.
Nothing becomes a marketing list
Someone who rang your business once is not a lead we sell, share or reuse. Their details are yours, used for your business, and nothing else.
Endpoints are locked down, not just obscure
Every inbound webhook is signature-verified. Cross-origin access is limited to named domains rather than a wildcard. Per-number rate limits stop both abuse and runaway cost.
Opt-outs are respected by the carrier, not by us
STOP, UNSUBSCRIBE and the rest are detected and the system falls silent so the carrier handles them properly. Replying to an opt-out is both rude and a compliance problem.
You own everything and can take it
Your prompt, your policies, your site, your playbooks, your content. On request we hand it over in a usable form and help your next person pick it up.
What is not true yet, said out loud.
We are a small company and we are not going to claim certifications we do not hold. We are not ISO 27001 certified and we are not SOC 2 audited. If your procurement process requires either, we are the wrong supplier today and we will tell you that on the first call rather than at contract stage.
There is no formal uptime SLA on the front desk yet. What exists instead is designed failure behaviour: if the voice greeting fails the caller still hears the right words, if the AI call fails the customer gets a human handover message with your email, and if a business is not configured the system greets and hangs up rather than pretending to text. Nothing in the chain fails silently at a customer.
If something does go wrong with your data, you hear it from us, in plain language, on the day we find out. Not in a quarterly summary.
Where things live
- Hosting and forms: Netlify
- Telephony and SMS: an Australian carrier account in your business name
- AI: Anthropic, on a capped key in its own billing workspace
- Voice: ElevenLabs, generated once then cached
- Email: Google Workspace
- Accounting: Xero
The spending cap, and the lesson behind it.
Public endpoints run on their own API key in their own billing workspace, capped at thirty dollars a month. A runaway loop cannot reach the rest of the business's AI budget.
That cap exists because of a mistake we made on our own account. The assumption was that a small prepaid credit balance was the ceiling. It was not: auto-reload was switched on and the organisation spend limit was two hundred thousand dollars. A loop would have kept topping itself up off the card indefinitely. Never treat a credit balance as a cap while auto-reload is enabled. It is now a standing check on every setup we do, including yours.
Standing checks on every setup
- Hard spend cap set before the first live call
- Auto-reload confirmed off or bounded
- Signature verification tested with a forged request
- Rate limits tested by exceeding them
- Opt-out tested with a real STOP
- Failure path tested by breaking it on purpose
Ask us the hard version of any of this
If you have a question this page does not answer, it is a good question and we would rather hear it before you are a client than after.