Security and data

Keys

• API keys (rl_live_...) are shown once and stored only as a SHA-256 hash. Revoke a key under Connect and it stops working within 30 seconds.
• Use keys only from your servers. The API allows cross-origin requests so server-side tools work, but a key in a browser can be copied.
• Upstream model keys for the Vapi proxy are encrypted with AES-GCM before storage and are never shown again.
• Dashboard passwords are hashed with PBKDF2-SHA256 (100,000 iterations). Sessions use an HttpOnly, Secure, SameSite=Lax cookie, and state-changing dashboard requests are checked for the dashboard's own origin.

What we store

For each checked turn: the call id, turn index, redacted caller text, redacted draft, what was said, the decision, fired rules, signals and latency. Retention depends on your plan: 7 days on Free, 30 days on Starter, 90 on Pro, and 180 on Agency. A daily job deletes older records. Our storage keeps a 30-day recovery log for disaster recovery, so deleted records can remain recoverable by us for up to 30 days after deletion.

With redactPII on (the default), phone numbers, email addresses, card numbers and Social Security numbers written as digits are replaced with placeholders before text is sent for checking and before anything is stored. The pattern rule for sensitive numbers runs on the raw draft first, in memory, so it can still block a reply that contains one.

Redaction is pattern-based. It does not catch numbers spoken as words ("four one five..."), names, street addresses or dates of birth, and numeric values inside context are sent as they are. Leave sensitive details out of context.

Staff access

Our support staff have no routine access to your data. Plan changes, temporary passwords (only after we verify you own the account email) and disaster recovery go through a token-protected operator tool that is switched off when not in use, and each action is recorded in our Worker logs.

Who processes it

• TypeSafe runs the classification model that answers the rule and signal questions.
• Cloudflare hosts the service and database.
• Stripe takes payments and runs the billing portal. We never see or store card numbers.
• Resend delivers account emails (email confirmation and password reset).

We don't sell data or use customer calls to train models. TypeSafe processes the text under its Master Customer Agreement. TypeSafe offers a zero data retention option per account. It is not enabled yet for Reflex Layer.

Healthcare

Reflex Layer is not HIPAA compliant, and we can't sign a Business Associate Agreement today because our model provider doesn't offer one. Don't send protected health information. The dental and medical starter pack is meant for scheduling and front-desk policy. Keep redactPII on, and get your compliance advisor's view before using it with patient calls.

Model limits

The rules are checked by a classification model, which can be wrong. That's why there's a review band, a review queue, code-based checks for prices, hours and card numbers, and a failure policy for slow responses. Reflex Layer reduces the chance of a bad sentence being spoken. It doesn't replace your own testing, call review or legal advice.