Security
Call Welcome answers your business's phone, so it handles your customers' names, numbers and what they need. Here is how we keep that safe.
Where your data is kept
Your business's details, call transcripts and messages are stored in Canada, on Microsoft Azure in Canada Central. Backups are copied to Canada East and kept 35 days.
The AI that answers your calls runs on Microsoft Azure. To keep it fast and available, Microsoft may process a call's audio and text in its data centres outside Canada. Microsoft doesn't use your calls to train its models.
Calls and texts travel through Twilio, our phone carrier. Payments are handled by Stripe.
Calls and voicemail
Calls are not recorded. A transcript of each call is kept so the business can review it.
If a caller leaves a voicemail, the audio is deleted once it has been transcribed.
Call records, transcripts and messages are kept 12 months. A closed business's are deleted 90 days after it closes.
Encryption
Every connection to Call Welcome uses HTTPS, and browsers are told to use nothing else.
Stored data is encrypted by Microsoft Azure.
Locked-down systems
The database and the AI service can't be reached from the internet. Only Call Welcome's own services reach them, over a private network.
Our keys and passwords live in Azure Key Vault, closed to the internet except, briefly, to us during maintenance.
A web firewall in front of the site limits how often anyone can try to sign in or sign up, and signup has a bot check.
The call service only accepts messages from the phone network that carry Twilio's signature.
Signing in
There are no passwords to steal. You sign in with a 6-digit code texted to your mobile. It expires after 10 minutes and allows 5 tries.
Only Call Welcome's owner has admin access.
Payments
You enter your card on Stripe's own page. Card numbers never reach Call Welcome, and we never store them.
How we run it
Every change is tested and reviewed before it's released.
We're alerted by text and email when something fails.
Our logs leave out phone numbers and what callers said.
No key or password is ever written into our code.
Report a security issue
If you think you've found a security problem, email security@callwelcome.ca.
Please don't access other people's data or disrupt the service while you look.