We handle sensitive business communications — inbound calls, customer transcripts, lead data. Our security program is built to protect it at every layer.
Every account is isolated. Users access only their own business data. Admin access requires separate authentication.
TOTP-based 2FA (Google Authenticator, Authy) is available for all accounts and required for admin roles.
Sessions expire after 30 minutes of inactivity. Tokens cannot be reused after expiry.
Minimum 8 characters with uppercase, lowercase, and numeric requirements. Passwords are hashed using scrypt with per-user salts.
All traffic is TLS 1.2+ enforced via HTTPS. HTTP connections are redirected. HSTS is enabled for all domains.
Database hosted on Neon PostgreSQL with AES-256 encryption at rest. Backups are encrypted.
API keys, 2FA secrets, and telephony credentials stored with AES-256-GCM field-level encryption.
All login events, settings changes, and data access are recorded with timestamps, IP addresses, and user agent.
Audit logs retained for a minimum of 90 days. Application logs retained for 30 days on Render's log infrastructure.
Runtime errors are captured with stack traces. Anomalous patterns trigger alerts.
Customers control their data retention period: 30, 60, 90, or 365 days. Call logs are automatically purged after the selected period.
Account deletion removes all call recordings, transcripts, leads, and associated data within 24 hours.
In the event of a suspected security incident:
1. Detect & contain — We isolate affected systems within 1 hour of detection. Access is revoked for compromised credentials.
2. Assess — We determine the scope: which data was accessed, how many accounts affected, and how long the exposure lasted.
3. Notify — Affected customers are notified within 72 hours of confirmed breach, per GDPR Article 33. Notifications include: what happened, what data was exposed, what we've done, and what customers should do.
4. Remediate — Root cause is fixed. Post-incident review is documented. Controls are updated to prevent recurrence.
To report a suspected security issue: security@dealgrip.com
| Vendor | Purpose | Data Stored | Compliance |
|---|---|---|---|
| Twilio | Voice calls, SMS | Call audio (temporary), SMS content | SOC 2 Type II HIPAA BAA |
| OpenAI | Call transcription, AI responses | Call transcripts (no persistent storage) | SOC 2 Type II |
| Stripe | Payment processing | Payment methods (tokenized) | PCI DSS Level 1 |
| Neon | PostgreSQL database | All application data | SOC 2 Type II |
| Render | Application hosting | Application logs | SOC 2 Type II |