Security

Where your data lives

Your account, your contact lists, your campaigns, your recordings and your texts are stored in Canada, in a data centre in Montreal. A backup is taken every day and the last seven are kept. Stored data is encrypted, and everything between your browser and us travels encrypted.

The servers that run the website and the dashboard, and some of the service providers that make the audio and deliver voicemails and texts, operate in the United States, so information passes through or is processed there to do that work. Our privacy policy lists the kinds of providers we use.

Signing in

• Strong passwords. A password needs at least 10 characters, and one found in a known data breach is refused. We keep only a secure hash, never the password itself.
• Two-step sign-in. Turn it on in your Security settings and every sign-in asks for a six-digit code from an authenticator app, never a text message. Once it's on, the database itself refuses your data to a session without the code.
• Your devices. Your Security settings list every browser and phone signed in to your login. Sign one out, or every device but the one in your hand.

Walls between accounts

Each account sees only its own lists, recordings, campaigns and texts. The wall is enforced inside the database on every table, and every request that names a campaign, a list or a recording is checked against the signed-in account before anything is read. Who belongs to an account, and at what level, is kept where no user can edit it.

On your team, the owner decides who joins. A Viewer can look but can't change anything, billing stays with the owner, and nobody can remove the owner.

When our team sees your account

Our team works with your account only to run the service: to review campaigns, look after delivery, your campaign line and billing, and help when you ask.

• Campaign reviews. Unless your account runs its own campaigns, our team checks each campaign's list, script and takes before it sends. Every campaign our team opens is in your Team activity.
• Support visits. When you ask for help, we open your workspace for a set time, read-only unless you've asked us to change something. The visit ends on its own and shows in your Team activity from start to end. Support can't buy credits or pay invoices.
• Our own sign-in. Every staff sign-in to our tools requires two-step verification.

Your lists and recordings

• Read in your browser. When you upload a spreadsheet, our own code reads it in your browser before anything is sent to us.
• Used for your campaigns only. Lists are never sold, never shared between clients and never used for our own marketing. Opt-outs are honoured.
• Private recordings. Voice profiles and takes are stored privately and play only through links that expire. A voice profile is used only for your own account's campaigns.
• Safe downloads. Spreadsheets you download from the dashboard are written so no cell can run as a formula when opened.
• Kept only as long as needed. A campaign's list is deleted 12 months after the campaign closes and its takes after 24 months, and a closed account's information 90 days after it closes. Email contact@thecallguy.ca to have anything deleted sooner. The details are in the privacy policy.

Payments

Payments are taken by Intuit (QuickBooks Payments) on Intuit's own secure page. Your card or bank details go straight to Intuit; we never see or store your card number.

The dashboard assistant

The assistant in your dashboard answers questions and drafts for you, but it can't send a campaign, spend credits, sign, or change anything without your own click.

If something goes wrong

If we learn of a breach that affects your information, we'll tell you within 72 hours of becoming aware of it: what happened, what it touched, and what we're doing about it. Where the law requires, we also report it to the privacy commissioner and keep a record of it.

Our privacy officer is responsible for how we protect personal information: Cohen Bell, Privacy Officer, cohen@thecallguy.ca.

Report a security problem

If you think you've found a weakness in thecallguy.ca or the dashboard, email contact@thecallguy.ca with what you found and how to reproduce it. We'll reply within three business days and keep you posted until it's fixed.

We welcome good-faith research, and we won't pursue anyone who follows these rules:

• Use only your own account. Never open, change or delete anyone else's lists, recordings or messages.
• Never send a voicemail or a text to anyone but yourself.
• No denial-of-service testing, no spam, and no tricking our team or our clients.
• Give us a reasonable time to fix it before you share it.

Our contact file for security researchers is at /.well-known/security.txt.

How we handle personal information: Privacy policy · Terms of service