CallForgesSecurity
This page explains how CallForges protects your account, your calls and the data we exchange with the tools you connect, such as Clio. For what we collect and why, see our Privacy Policy.
1. Where your data is
Our application and database servers are in the United States. Our databases are not reachable from the internet: only our web server accepts outside connections.
2. Encryption
- All traffic to our website, app and API uses HTTPS (TLS).
- Data is encrypted at rest, including our databases and stored recordings.
- Access to the CRMs you connect is stored encrypted with AES-256-GCM.
3. Sign-in and passwords
- You can sign in with Google instead of a password.
- Passwords are stored only as Argon2 hashes, never in plain text.
- A new password is checked against known breached passwords. Only the first five characters of its hash leave our servers.
- Repeated failed sign-ins are rate limited and lock the account for a while.
4. Access control
- You decide who can do what in your workspace with roles and permissions. Only owners and admins can connect, change or disconnect an integration.
- Our internal admin console requires a password and an authenticator code.
5. Connected CRMs
- You connect a CRM through its own sign-in page. We never see or store your CRM password.
- We ask only for the permissions our features use, and use them only for those features, such as logging your calls.
- When you disconnect Clio, we revoke our access at Clio, delete our access tokens and remove the Clio names we held for that connection. Nothing in your Clio account is deleted.
6. Recordings and AI
- You choose, for each phone number, whether calls are recorded and transcribed.
- Recordings are kept in private storage. By default, a recording can't be shared outside CallForges, and inside it only members allowed to listen to calls can play it.
- Our AI subprocessors may use the data only to provide the feature to us and may not use it to train their own models.
7. How we build
- Every change is reviewed and must pass automated code analysis and tests before it is released.
- Database queries are parameterized, and every request is checked against your workspace and your permissions on the server.
8. Backups
We take a snapshot of our servers every day and keep each one for 7 days.
9. If something goes wrong
If a data breach is likely to affect you, we will notify you and the relevant regulators as the law requires.
10. Report a problem
If you find a security issue, write to support@callforges.com. Please give us a chance to fix it before telling anyone else.