Security

Last updated: [DATE]

Security is built into how Callable is designed and run. This statement summarises our approach; customers under NDA can request further detail.

Infrastructure

• Hosted on hardened cloud infrastructure in the United Kingdom / European Union.
• Each customer's configuration and data are isolated to their own tenant.
• Encryption in transit (TLS) across our public interfaces, and encryption at rest for data stored on our platform.
• Network controls, least-privilege access and continuous monitoring protect the service.

Communications

• Signalling is protected with TLS and media can be encrypted (SRTP) where supported end to end.
• Recordings and transcripts, where enabled, are stored encrypted and access-controlled, and retained according to your tenant's configuration.
• Fraud and abuse controls protect against toll fraud, traffic pumping and unauthorised use.

Access and operations

• Role-based access control for customer accounts; administrative access to our systems is restricted, logged and reviewed.
• Change management, backups and disaster-recovery processes keep the service resilient.
• Staff are vetted and trained on security and data protection.

Reporting a vulnerability

If you believe you have found a security vulnerability, please contact security@callable.io. We welcome responsible disclosure and ask that you give us a reasonable opportunity to investigate and remediate before any public disclosure. Please do not access or modify other users' data, degrade the service, or run disruptive testing.

Compliance

We align our practices with recognised security standards and applicable telecoms and data protection regulation. [Certifications and attestations — e.g. ISO 27001, SOC 2 — to be listed here once in place.]