Skip to content
EchoCody AI
Book

Security and privacy

Built so the sensitive parts never leave the server.

You are handing a voice system your phone line, your calendar and your customer records. This page states plainly how that data is handled. It claims no certification and no audit outcome, because none has been issued. What is described here is how the system is actually built.

How the platform is protected

Secrets never reach the browser

API keys, model prompts, telephony credentials and CRM tokens are held server side and used only inside server functions. Nothing sensitive is compiled into the code a visitor can read.

Least privilege on every table

Call records, latency samples, consent events and security events are closed to public and signed in roles alike. Only the server role reaches them, and only through the one module allowed to touch each table.

Encrypted in transit

Every request to the site, the voice pipeline and the database runs over TLS. The site sends strict transport security, a content security policy, and frame and content type protections on every response.

Written access is guarded

Public endpoints validate their input against a schema, reject anything oversized, rate limit by client, and carry honeypot and timing checks on forms. Webhooks are rejected unless the signature verifies.

Denials are alerted, not swallowed

A permission or policy refusal is recorded as a security event with the table and operation, never the row contents, and alerts on the first occurrence rather than waiting for a pattern.

Data is kept because it is needed

Contact details, call outcomes and consent state are retained to run the service and to prove what was agreed. Retention windows and the full data inventory are published on the trust and data page.

Security practices checklist

Every item below is a protection the site sends on each production response. The list is read from the live policy, so it cannot claim a control that is not switched on.

  • Content security policy enabled

    The browser is told exactly which scripts, styles, frames and network destinations are allowed. Anything else is blocked and reported.

    Content-Security-Policy

  • Strict transport security enabled

    Browsers are instructed to use HTTPS only for a year, including subdomains, so a downgrade to plain HTTP cannot be forced.

    Strict-Transport-Security

  • Referrer policy enabled

    Full page addresses are not leaked to third parties. Cross-origin requests carry the origin only.

    Referrer-Policy

  • No content type sniffing enabled

    The browser must honour the declared content type instead of guessing, which closes a class of upload and injection tricks.

    X-Content-Type-Options

  • Framing denied enabled

    The site cannot be embedded in another page, so a click on this site cannot be hijacked by an overlay.

    X-Frame-Options

  • Hardware permissions locked down enabled

    Only the microphone is available, and only to this site. Camera, location, payment and sensor access are switched off.

    Permissions-Policy

  • Isolated browsing context enabled

    Other sites cannot keep a handle on this window after navigation.

    Cross-Origin-Opener-Policy

  • Resources stay same site enabled

    Assets served here cannot be pulled into an unrelated origin.

    Cross-Origin-Resource-Policy

  • Pages revalidate on every view enabled

    Page responses are never served from a stale cache, so a security fix or policy change reaches every visitor on their next request.

    Cache-Control (pages)

  • Build assets pinned by content hash enabled

    Scripts and styles carry a content hash in the filename and are cached for a year, so a cached file can never be a different file than the one that was published.

    Cache-Control (assets)

  • API responses never stored enabled

    Anything returned by an API route is marked no-store, so request data does not linger in a browser or proxy cache.

    Cache-Control (API)

  • Private routes excluded from search enabled

    Operator consoles, call records and API routes are marked noindex at the response level, independent of robots.txt.

    X-Robots-Tag

  • Violation reporting is live enabled

    Policy violations are reported back to the site and reviewed by the continuous security monitor rather than being silently dropped.

    Reporting-Endpoints

How call data is treated

Disclosure
Callers are told they are speaking with an AI assistant at the start of the call. It is not concealed and it is not buried.
Consent and opt out
Stop, do not contact and wrong person signals are honoured immediately and recorded in a consent ledger that outranks any campaign or cadence.
Recording
Recording and transcript handling follow the rules of the caller's jurisdiction, configured per location before launch.
Your records stay yours
Contacts, appointments and notes are written into the CRM you already control. Leaving does not strand your data with us.

Reporting a security issue

If you believe you have found a vulnerability, email security@echocody.ai with enough detail to reproduce it. We will acknowledge the report, tell you what we found and tell you when it is fixed. Please do not run tests that degrade service or touch data that is not yours.

Where the rest of it lives

Ask us anything on a fit call