[ 00 ] // Security and data
Plain answers about your data.
What we store, where it runs, who else touches it, and how to get it deleted. This page is written to answer the questions security reviews actually ask. Last reviewed October 2026.
[ 01 ]
What we store
- Prospects you upload or import: name, company, title, phone numbers, email, and the CRM fields you choose to bring across for context.
- Call records: the number dialed, the outcome your rep picked, notes, talk time, and timestamps, including calls nobody answered.
- When recording or AI notes are on: the recording, its transcript, the AI summary, and next steps for each connected call.
- Account data: your reps' names, emails, and login details, your caller IDs, and your billing status. Card details live with Stripe, never with us.
[ 02 ]
Where it runs
- The application and the voice network run on Amazon Web Services in the United States. The database and file storage run on Railway, also in the United States.
- Traffic between your browser and CallCloud, and between CallCloud and every provider below, is encrypted in transit with TLS.
- Reps sign in with email and password or with Google. Admin and rep roles control who can see team-wide calls, recordings, and settings.
[ 03 ]
Providers that touch your data
- Carriers that place the calls: Flowroute and Twilio, with the caller IDs you own in CallCloud. Both are US-based.
- AssemblyAI transcribes recordings, only when recording or AI notes are switched on for your workspace.
- Anthropic generates AI call summaries and pre-call research briefs from the transcript and the prospect's public company information.
- Stripe handles billing. Resend sends transactional email. Supabase stores demo requests and founder chats from this website.
- Your CRM, if you connect one. CallCloud writes calls, outcomes, and notes to your CRM, and where the integration supports it, the recording link and AI summary. Connection tokens are stored server-side and deleted the moment you disconnect.
[ 04 ]
Recording and consent
- Recording is off by default and switched on per workspace by an admin. When it is off, no audio is stored and no AI notes are produced.
- Consent and notice rules for recording vary by state and country and are the caller's responsibility, the same as on any dialer. Our terms put that responsibility with you, and calling hours are enforced in each prospect's local time zone to keep you inside the rules that we can enforce for you.
- Managers can listen to and barge into live calls from the live monitor. That is visible to the rep in the dialer.
[ 05 ]
Retention and deletion
- Nothing expires on its own. Prospects, calls, recordings, and transcripts stay until you delete them, so your history is complete for as long as you want it.
- Reps and admins can delete prospects and recordings from the app. To delete a whole workspace and everything in it, email richard@callcloud.app from the admin's address and it is done within 30 days, with written confirmation.
- Webhook and diagnostic logs are pruned after seven days.
[ 06 ]
Questionnaires and disclosure
- Security questionnaires are answered by the founder, usually within two business days. Send them to richard@callcloud.app.
- If you find a security issue in CallCloud, email the same address. We read every report and reply to the ones that identify a real problem.
- We do not currently hold a SOC 2 report. If your procurement process needs one, tell us and we will say plainly where we are.
[ 07 ] // Start dialing
The zero lag parallel dialer.
Dial up to five prospects at once and connect the instant someone picks up.