Security at CallCovered

CallCovered handles two kinds of data a contractor cares about: the phone numbers and messages of the people who call them, and the business's own contact and billing details. This page says what we do to protect both. If you want the underlying policies or a provider's audit report, ask.

1. Where the service runs

We do not operate our own servers. Each layer of the service runs on a provider whose job is that layer, and each of those providers publishes its own independent security attestations, which we keep on file:

• Vercel: the website, the customer dashboard and the API. TLS on every request, DDoS protection and isolated builds are theirs.
• Supabase: the database (Postgres). Encryption at rest, daily backups and network isolation are theirs.
• Stripe: payments. Card numbers are entered on Stripe's checkout page and never pass through our systems. Stripe is a PCI DSS Level 1 service provider.
• Twilio: the phone numbers, calls and text messages, under US A2P 10DLC registration.
• Resend: transactional email (sign-in links, receipts, notifications).

2. Who can reach the data

• No passwords. The rep and admin portal signs in by a one-time email link that expires in 15 minutes. Only a hash of the link is stored, so a copy of the database cannot be used to sign in. Sessions expire after 14 days and are sent as HttpOnly, Secure cookies.
• The browser never talks to the database. Every read and write goes through our API, which checks who is asking on every request. Row-level security is enabled on every table, so even a leaked public API key returns nothing.
• Least privilege inside the company. Kept Labs is a small company; the number of people with production access is correspondingly small, each with their own account, and the written Access Control policy requires multi-factor authentication on every provider console. Access is reviewed and revoked as part of that policy.
• Secrets live in the hosting platform, never in source code. The repository is private, and checking its full history for accidentally committed credentials is part of our readiness checks.

3. How changes reach production

Every change is committed to version control and goes through an automated check (type checking, the full test suite, and a build) before it is considered done. Dependencies are monitored for published vulnerabilities on every run of that check and updated on a schedule. A change that cannot pass those checks does not ship.

4. What we watch

The service keeps an audit trail of the events that matter: provisioning of a new customer's number, every sign-in link issued, every payment event received, and every commission decision. A daily digest reads that trail and reports anything that needs a person: a failed setup, unusual sign-in activity, or a payment webhook that has gone quiet.

5. What we keep, and for how long

We hold what the service needs to work: your business contact and configuration details, the phone numbers and message content of the callers you asked us to text back on your behalf, and billing records held by Stripe. Retention periods and what happens when an account is closed are set out in our written Data Classification & Retention policy and summarised in the Privacy Policy. For caller data we act as a processor on your behalf; it is your customer's data, and we use it for nothing except the service you configured.

6. SOC 2

We are working toward a SOC 2 report and run the business against written policies covering information security, access control, change management, incident response, vendor management, data retention and business continuity. We do not yet hold a SOC 2 report, and we will not describe ourselves as SOC 2 compliant until an independent auditor has said so. Customers with a security review to complete can request the policy set and our provider reports under NDA at the address below.

7. Reporting a security problem

If you believe you have found a vulnerability in CallCovered, email brandon@getcallcovered.com with enough detail to reproduce it. We will acknowledge within two business days, keep you informed while we fix it, and credit you if you would like us to. We do not run a paid bounty program. Please do not test against live customer phone numbers or accounts, and do not access or retain data that is not yours. If you reach it by accident, stop and tell us. Machine-readable contact details are at /.well-known/security.txt.

8. If something goes wrong

Our Incident Response policy commits us to contain first, then tell the people affected. If an incident involves your data, you will hear it from us directly, with what happened, what we did, and what, if anything, you need to do.