Security

#Signing in

• Sign in with email and password, or with Google.
• Turn on two-step sign-in under Settings → Profile & security with any authenticator app. You get backup codes for when your phone isn't to hand.
• The same page lists your signed-in devices, and you can sign any of them out.
• Password reset links expire after an hour and stop working once the password changes.

#Your data

• Every record belongs to one business, and every request is checked against it. API keys act on one business only.
• Secrets for tools, models and apps are encrypted and never shown again after saving.
• Recordings are only served to signed-in members of your business.
• Changes such as new API keys and cloned voices are recorded in an audit log.

#Calls

• Custom tools and webhooks can only reach public addresses.
• Code tools run in an isolated sandbox with no access to your data or other businesses.
• Only registered trunks and allow-listed IP addresses can reach the SIP gateway, and repeated failed attempts are blocked.