Security and data protection

• Two-step verification

  Authenticator app (TOTP), 10 single-use recovery codes and devices remembered for 30 days. The workspace owner can require it for every member; each change is e-mailed to the account owner.

• Sessions

  Open sessions are listed; you can end one or sign out every other device. Access tokens last 15 minutes and refresh tokens change on every use.

• Sign-in protection

  Repeated failed sign-ins lock the account for a while. Passwords are stored with bcrypt, and paid actions need a verified e-mail address.

• Sign in with Google

  People can sign in with Google; an e-mail address Google has not verified cannot claim an existing account.

A workspace has owner, manager and operator roles; the manager and operator roles can be edited, and custom roles can be built from the permission catalogue. Role management, company settings, releasing numbers and permanent deletion are for the owner only. Nobody can grant more than they hold.

• Sign-ins and failed attempts, sessions, two-step verification, roles, API keys, settings, webhooks, numbers, call flows and compliance settings are recorded.
• Data access such as playing or downloading recordings, viewing transcripts and exports is recorded too.
• Rows are chained together, and the dashboard can verify that the log has not been altered. It exports as CSV or JSON and can be streamed to your security monitoring by signed webhook.
• Records are kept for 730 days.

• Each workspace's data is separated in the database with row-level security policies.
• Every workspace has its own encryption key. OAuth and provider keys, SIP passwords and webhook secrets are encrypted with it using AES-256-GCM.
• Call recordings are stored encrypted with the workspace's key as well.
• Every connection is encrypted with TLS, and HSTS tells browsers to use HTTPS only.

• Recording playback links are signed and valid for one hour.
• Retention is set per workspace from 1 to 3,650 days (180 by default); expired recordings, transcripts and messages are deleted daily.
• A recording notice plays before the assistant's first line by default.
• Masking personal data in transcripts can be turned on.

• A person's data can be exported or erased in one step; each erasure leaves a signed deletion record kept for at least 3 years.
• The data requests screen tracks requests against the 30-day legal deadline.
• The workspace owner can export all data as an encrypted archive.
• When an account closes, the workspace's data and encryption keys are deleted.

• Calling hours: operators are warned when they call outside the allowed hours, and voice agent calls keep to them.
• A do-not-call list, plus inbound blocking by number, prefix or withheld caller ID.
• An optional İYS consent check for campaigns.
• For Turkish numbers, an assistant cannot go live without an AI disclosure.

• Webhook requests are signed with HMAC-SHA256 and a timestamp; their secrets are stored encrypted.
• API keys are shown once, stored only as a hash, limited by scope and revocable.
• Apps connect with OAuth 2.1 and PKCE after the user approves; connected apps can be removed in the dashboard.
• Webhooks from providers are signature-checked, and the addresses you enter are checked against internal-network access.

• Personal data is masked before error reports are sent.
• Services are watched with uptime checks and alerts; the API sits behind a web application firewall and DDoS protection.

To report a vulnerability or ask a security question, write to hello@speakline.io.

Privacy PolicyKVKK Notice