SECURITY AND TRUST

What we do to protect your calls and your customers.

The controls that exist today, described plainly, and the ones we have not built yet.

We are not certified or audited.

We hold no security certification and have not been through an outside audit. We have mapped our own controls to the themes used in common frameworks, as groundwork for an audit later. That is a to-do list, not a credential.

Controls in place

Who can see what

Access is by role. There are six roles, and the check runs on the server for every portal and admin page and action.
Client accounts have owners and staff. Billing, Developers and Team are for owners.
When our staff open a client account to help, it is a time-limited session (2 hours), flagged on the session, and every change they make is logged with their name. In that session they cannot create API keys or webhooks, invite or remove people, or connect a calendar.
Owners can remove a team member or sign them out of every device from Settings, Team.
Passwords are stored as scrypt hashes (N = 2^17). Session tokens are stored as SHA-256 hashes. Sign-in attempts are rate limited per network address and per account.

Secrets and keys

Google Calendar refresh tokens and webhook signing secrets are encrypted at rest with AES-256-GCM.
API keys are shown once and stored hashed. You can revoke one at any time.
In production, the app refuses to start if the default encryption or auth secrets are still set.

Phone numbers and call data

Phone numbers are masked in our logs. Transcripts are stored in the database, not written to logs.
Caller numbers are partly hidden in the Inbox and in call summary emails.
The agent never takes card numbers by voice. Invoices are paid on a separate secure payment page.

Webhooks and API

Inbound webhooks from our phone provider are signature-checked, and each event is processed once, even if it is delivered twice.
Webhooks we send you are signed with HMAC-SHA256 and a timestamp, so you can reject forged or replayed requests.
Webhook URLs must be public HTTPS addresses. Private and internal addresses are blocked, checked again at delivery time, and the connection goes to the address that was checked.
Each API key is limited to 120 requests a minute. Client keys only see their own data.

The agent cannot invent facts

Hours, closures, service area, availability and prices come from your records through lookups, not from the model.
Bookings pass checks done in code: open hours, ZIP, notice, and whether the slot is still free. A retry cannot double-book.
Agent tools only act for the person on the call. Finding, cancelling or rescheduling needs a caller ID and name match, and there are no bulk actions.
Anything a caller says is untrusted input. Instructions such as "ignore your rules" do not change what the tools allow.

Audit trail and change control

An audit log records configuration changes, billing and price changes, impersonation sessions, team changes, and API key and webhook changes.
Pages are served with a strict content security policy, HSTS and anti-framing headers.
Every change to your business profile after go-live is a new saved version, and each call records which version it used.
Our code changes go through automated typecheck, tests and an end-to-end run, and architectural decisions are written down.

Being clear about AI and recording

AI disclosure

The agent answers honestly when a caller asks whether it is an AI.
You can choose to have the greeting say so every time, under Voice & persona.

Recording

Recording is off unless it is enabled for your account, and it only happens while the recording notice is also on in Voice & persona.
A recording notice can be played at the start of every call. Some states need every party to consent, so keep it on if you record.

How long we keep data

Call transcripts: One year by default, configurable per client.
Call recordings: 90 days by default, configurable per client.
Deletion: A daily job deletes transcripts and recordings that are past their limit. The call record, its summary, appointments and messages are kept. To have other data removed, contact us.

Read the full text in our Privacy policy, Data processing addendum and AI & recording disclosure. The vendors that process data for us are on the sub-processor list. These are drafts, still pending legal review.

What we have not built yet

You should know these before you decide.

Two-factor sign-in and single sign-on: Sign-in is email and password today.
Off-site audit log: The audit log lives in our own database. We do not yet ship it to a separate store.
Published incident response runbook: Not written yet. See the status page for current service health.
Healthcare and other regulated data: Ringwise is built for home-service trades. It is not designed for health or legal data.

Found a security problem, or have a question for your IT person? Tell us through the contact form and mention security.

Last reviewed Oct 13, 2026