1. Security Overview
TrustCall uses reasonable technical and organizational safeguards designed to protect information and service availability. Security depends on configuration, deployment, providers and customer practices. This overview is not an independent audit, certification or guarantee; request account-specific information from [Security Email].
2. Access Controls
The application uses authenticated access and account/tenant associations to control protected operations. Administrative permissions govern management functions. Access should be limited to legitimate responsibilities and removed when no longer required; no policy statement substitutes for reviewing actual access configuration.
3. Authentication
The platform supports account authentication and token-based access. Customers should use strong, unique passwords, protect external sign-in accounts and use additional protections where available. SIP credentials and device sessions require protection as well as the primary account.
4. Encryption
Use the published HTTPS service URLs for browser and API traffic. Encryption of call signaling, media, stored information and provider links depends on the particular deployment and connection. This page does not promise end-to-end calling encryption or universal encryption at rest. Contact [Security Email] to confirm controls required for your use case.
5. Network and Infrastructure Security
Service protection involves infrastructure configuration, restricted administrative access and provider controls. Customers must secure their devices, networks and PBX integrations. No claim is made here that every deployment has a particular firewall, network certification or security appliance.
6. Logging and Monitoring
Operational, authentication, billing and calling events may support troubleshooting, fraud prevention and security review. Error reporting is integrated into the platform. Logs may contain identifiers or request context and should be treated as sensitive; monitoring is not a guarantee that every incident will be detected.
7. Backup and Recovery
Backup coverage, retention and restoration arrangements depend on operational deployment and any contracted commitments. Do not assume a particular recovery time, recovery point or restoration of released phone numbers. Confirm required arrangements with support and retain authorized copies of business-critical records where appropriate.
8. Vulnerability and Security Management
Security issues should be assessed and remediated according to their impact and available mitigations. Dependencies and configurations require ongoing review. Report suspected vulnerabilities to [Security Email]; do not access other users' data, disrupt service or exceed an authorized testing scope. No unverified penetration-test or audit schedule is claimed.
9. Incident Response
Suspected incidents should be reported promptly so they can be assessed, contained and investigated. We may restrict access or calling to protect accounts and networks. Communications and notifications are handled according to applicable law and contractual obligations, rather than an unverified universal notification deadline.
10. Employee and Contractor Access
Personnel or contractors may need access for support, operations, verification or security. Such access should be limited to authorized purposes and appropriate confidentiality obligations. This page does not claim a particular employee screening or certification program.
11. Third-Party Providers
Telecom/SIP, cloud, payment and diagnostic providers have their own controls and responsibilities. They may process information necessary for service delivery and compliance. Discuss required assurance or contractual terms before using the Services for sensitive or specially regulated information.
12. Customer Security Responsibilities
Protect accounts, devices, SIP extensions and integrations; maintain supported software; limit administrator access; and investigate unusual usage. Obtain recording consent and secure recordings, KYC materials and CDR exports. Notify support promptly when an account or device is compromised.
13. Security Limitations
No system or network is completely secure, and outages or unauthorized access cannot be ruled out. This page does not assert SOC 2, ISO, HIPAA, PCI DSS or other certification, regulatory approval, or suitability for a regulated workload. Any required assurance must be separately verified.
14. Security Contact
Report vulnerabilities or security concerns to [Security Email]. Provide reproducible details and relevant timestamps without exposing passwords, private keys or unnecessary personal information. For account assistance, contact [Support Email]. Provider: [Company Legal Name], [Company Address].