Security Is Built Into Everything We Do
Your data, your training sessions, and your team's information are protected by multiple layers of enterprise-grade security controls.
SOC 2 Type 2 Infrastructure
Hosted on cloud infrastructure independently audited under SOC 2 Type 2
GDPR-Ready
Privacy-first data practices designed to support GDPR requirements
CCPA-Aligned
Data handling practices aligned with California privacy law
AES-256 Encryption
All data encrypted at rest and in transit
Our Commitment to Security
Security isn't a feature we bolt on, it's the foundation of everything we build. From the first line of code to the infrastructure that serves your training sessions, we design for security at every layer. We continuously review, test, and improve our defenses, and we host on infrastructure that is independently audited to the highest industry standards.
Infrastructure & Data Protection
Call Flow runs on cloud infrastructure that is independently audited under SOC 2 Type 2, with automatic scaling, redundancy across multiple availability zones, and strong physical security controls including biometric access, 24/7 surveillance, and environmental protections.
Encryption & Access Controls
All data is encrypted in transit using TLS 1.2+ and at rest using AES-256 encryption. We enforce role-based access controls (RBAC) across the platform, ensuring that users only access data they're authorized to see. Access to production systems is limited to authorized team members.
Continuous Security Review
We run automated vulnerability scanning continuously and keep our dependencies promptly updated. All findings are triaged, prioritized, and remediated so that security issues are fixed quickly and thoroughly.
Incident Response
We follow a documented playbook for identifying, containing, and remediating security incidents. If a security incident ever affects your data, we commit to notifying affected customers within 72 hours, in compliance with applicable regulations.
Customer Data Ownership
Your data belongs to you. We never sell, rent, or share your training data with third parties for their own purposes. You can export or delete your data at any time. When you cancel your account, we permanently delete your data within 30 days.
Have Security Questions?
Our security team is happy to discuss our practices in detail. For enterprise security reviews or documentation of our security practices, contact us at security@callflow.dev.