Security & Data Protection
We take information security seriously. This page describes what we do today to protect your business and client data.
1. Where Your Data Is Stored
Client and business data is stored in our own secured database in Canada, encrypted at rest and in transit, and isolated per business — no cross-tenant access. Live calls are carried by our telephone provider (Twilio) and answered by Google's AI, which process the call in the United States while it happens. We act as your data processor, never the data owner, and a Data Processing Agreement is part of every subscription.
2. Encryption Standards
All data in transit is protected by TLS encryption. Live call audio is streamed over secure WSS (WebSocket Secure) between our telephone provider and our processing infrastructure, and access to your business tools, such as your Google Calendar, is granted by you and can be revoked at any time.
3. Security Inheritance
Your calendar stays in your own Google Workspace, so calendar-side security inherits directly from Google's infrastructure — 2FA, advanced threat protection, and SOC 2 Type II compliance. Your stored client and business records inherit our own infrastructure's security instead, described in Section 1 above.
4. Never Used to Train AI
Your business and client data is never used to train, fine-tune or improve AI models — ours or anyone else's. See Section 6 of our Privacy Policy.
5. Caller PIN
On plans with caller PIN security, a new caller sets a 4-digit PIN at their first booking, and the PIN is asked for before an appointment is changed or cancelled — so someone else calling from or about that client can't change their bookings. PINs are stored hashed, never in plain text.