SMS WORKFORCE OSSAMANTHA AI ANSWERING
SECURITY

Built for business. Designed for control.

The controls that are actually implemented, described plainly — and an honest statement of what we do not claim.

  1. Sign-in is Google OAuth 2.0 with PKCE. There is no password to store, because the platform does not use one.
  2. Session cookies are set HttpOnly, so page scripts cannot read them.
  3. Role-based access control across four roles, checked on the server for every authenticated route.
  4. Multi-tenant data isolation: requests are scoped to the caller's own organization in the application layer.
  5. Audit logging of privileged and tenant-affecting actions.
  6. Server-side credential protection: provider and API keys stay on the server, and provider error messages are scrubbed so key material cannot be returned to a browser.
  7. Human oversight and deployment controls: a call handler must pass readiness checks and be approved before it can take a live call.
  8. Rate limiting on public endpoints.
  9. We don't claim uncertified compliance. Where we have not been audited against a standard, we say so rather than implying otherwise.
  10. Security practices will keep changing as the platform develops. This page describes what is in place today, not an aspiration.

Questions about anything on this page, or a request about your own data? Get in touch.