Security

We handle phone calls, messages, and customer data for real businesses, so we take security seriously. Here is exactly how your data is protected — every claim on this page is verifiable.

A

Grade A on securityheaders.com

Our HTTP security headers are independently rated. Click to re-run the live scan yourself.

Encryption

  • All traffic is served over HTTPS/TLS — HTTP Strict Transport Security (HSTS) is enforced with a two-year max-age.
  • Data is encrypted at rest by our infrastructure providers (Supabase / Vercel).
  • Secrets and provider API keys are stored encrypted, never exposed to the browser.

Application hardening

  • A Content-Security-Policy restricts what can run in the page (object-src none, base-uri self).
  • Clickjacking protection (X-Frame-Options: SAMEORIGIN), MIME-sniff protection (nosniff), and a strict Referrer-Policy.
  • A Permissions-Policy switches off device APIs the app doesn't need (camera, geolocation, USB, sensors).

Authentication & access

  • Accounts are managed by Clerk, a dedicated identity provider — with support for multi-factor authentication.
  • The programmatic API is authenticated with per-account bearer keys you can rotate.
  • Bring your own provider keys (BYOK): your keys stay scoped to your account.

Payments

  • All payments are processed by Stripe (PCI-DSS Level 1).
  • We never see or store your full card number — it goes straight to Stripe.
  • Usage-based billing, no subscription — cancel any time.

Infrastructure

  • Hosted on Vercel with a Postgres database on Supabase.
  • DNS and edge protection via Cloudflare.
  • Uptime is monitored continuously — see our live status on the sub-processors page.

Data & privacy

  • Every third-party we rely on is listed publicly, with what it processes and where.
  • Where a provider supports it, we enable no-training / opt-out and zero retention by default.
  • Configurable data-retention controls let you decide how long call and message data is kept.

For the full list of the third-party providers we use — and exactly what each one processes — see our sub-processors. Our data practices are covered in the privacy policy.

Found a security issue? We appreciate responsible disclosure — email support@customweb.ai and we'll get back to you.