Security

What protects your calls and your customer list.

SiteCall handles your phone number, your call recordings, and your customers' contact details. Here is how that is protected, stated plainly — including what we don't yet claim.

Encryption

All traffic to SiteCall is served over TLS with HTTP Strict Transport Security enabled, and our connection to the database is encrypted in transit. Database backups are encrypted with AES-256 on our server before they leave it. Access tokens for third-party services get a second layer of AES-256-GCM encryption in our application before storage, so database access alone does not yield usable credentials. Voice carried over your browser is encrypted by WebRTC, which mandates encrypted media.

Tenant isolation

Each workspace's data is separated at the database level using PostgreSQL row-level security rather than application-layer filtering alone, so a query missing a workspace filter returns nothing instead of another business's records.

Workspaces and numbers

Every business on SiteCall works in its own workspace. Products that build on SiteCall get a separate managed workspace for each business they serve: an application's key reaches only the workspaces that application manages, and every API request is confined to one workspace.

A number's history belongs to the business that used it. When a number leaves a workspace, its calls, texts, voicemails and transcripts stay behind with that business, and the next holder starts with a clean history. We refuse to move a number while a call on it is still live.

When a number does change hands, we clear the business name it showed on calls and the emergency address on file for it, so the next holder inherits neither.

A number a business releases returns to our shared pool and waits before anyone else can have it: nobody can take it until 45 days after release, or 90 days if it placed calls or sent texts in its last 90 days, and for the first 15 days a business on a product built on SiteCall can reclaim a number it released. Before a pooled number is offered again, we clear its caller name, its emergency address and its texting registration.

Inside a workspace, people see the numbers assigned to them: every call, text, recording, voicemail and transcript of those numbers, plus the calls they handled themselves. Supervisors also see what they oversee, and owners and admins see everything in the workspace. A workspace can limit recordings and transcripts to supervisors and above. When the operator of a product built on SiteCall needs to see the recordings, transcripts or message text of a business that product manages, it needs a grant with a stated reason that lasts at most 24 hours, and each grant, its use and its end are recorded in that business's audit log.

Payments

We never see or store your card details. Card entry happens entirely on pages served by Stripe, a PCI-DSS Level 1 certified provider; we keep only the brand and last four digits for display. Three independent automated checks block any change that would start collecting card data on our own pages.

Access, logging, and recovery

Administrative access to production is held by the smallest number of people who need it. Reads and exports of customer data on our most sensitive endpoints are written to an append-only audit log that cannot be edited or deleted through the application. Database backups run on a schedule and are stored encrypted in a separate data center from the database server. How long data is kept and what the audit log records are on the trust center.

Policies and vendors

We keep a risk register and written security policies. The set that covers SiteCall (information security, access control, change management, incident response, vendor management and data retention) is still in draft and has not been approved yet. The companies that process customer data are listed on the subprocessors page.

What we don't claim

Security pages are easy to inflate. We would rather name these than let you assume otherwise. We are not SOC 2 or ISO 27001 certified — we maintain the underlying controls and documentation, but no external auditor has attested to them. We have not completed an independent third-party penetration test. We publish measured availability on our status page; it is not a service-level agreement and no credits are tied to it. SiteCall numbers are US numbers only.

We are not HIPAA compliant and do not sign Business Associate Agreements, so please don't put protected health information into SiteCall. And we do not offer end-to-end encryption: call recording, transcription, and AI assistance all require our systems to process your content in readable form.

Reporting a vulnerability

Email support@sitecall.ai with steps to reproduce. We aim to acknowledge reports within three business days. Please give us a reasonable window to fix an issue before disclosing it publicly, and avoid accessing accounts or data that aren't yours while testing. We don't run a paid bug bounty, and we won't pursue legal action over good-faith research that follows these guidelines.