Protecting data
Encryption in transit
Every page and every connection to the FrontDesk Talk website, apps, and API uses HTTPS (TLS). Our document storage refuses any connection that isn’t encrypted.
Encryption at rest
Our database and file storage are encrypted at rest by our hosting providers, MongoDB Atlas and Amazon Web Services.
Extra encryption for secrets
Calendar connection tokens, each business’s phone account credentials, and our staff’s two-factor secrets are encrypted again with AES-256-GCM before they are saved.
Hashed passwords
We never store your password as text. Passwords are hashed with bcrypt before they’re saved.
Payments by Stripe
Card details go straight to Stripe, our payment processor. We never see or store your full card number.
A separate phone account per business
Each business gets its own Twilio subaccount, so its numbers, calls, and texts are kept apart from every other business.
Controlling access
Role-based access for your team
Owners, managers, and staff see and do different things. For example, only owners and managers can request or delete client documents, and only the owner changes document settings.
Sessions that end
Resetting your password signs out every device. Signing out of the mobile app removes that phone from notifications.
Sign-in protection
Sign in, password reset, and signup are rate limited to slow down password guessing and abuse.
Two-factor authentication for our staff
Our admin tools require an authenticator app. Each staff member gets only the permissions their role needs.
Every staff action logged
Changes our staff make in our admin tools are written to an audit log with who, what, and when.
Limited “view as customer”
When support views an account to help you, the session lasts one hour, is logged, and can’t open, download, or delete your documents or change billing.
Calls, texts, and documents
Checked messages from providers
Messages from Stripe, Twilio, and our voice AI provider are checked with signatures or secret tokens before we act on them.
Private document links
Callers upload documents through a link made for one person. Links are long random codes, are stored only as a hash, and expire (7 days by default).
Virus scanning and type checks
Every uploaded file is checked for its real type and scanned for viruses before it is stored. Infected files are never stored or shown.
Short-lived downloads and an access log
Download links last five minutes. Every view, download, and deletion of a document is recorded with who and when.
Protective notifications by default
Unless a business tells us its callers don’t share health information, texts, emails, and push notifications leave out the caller’s name, number, call summary, intake answers, and text message words. The details are only in the app. A business can choose to email the intake answers it hasn’t marked as health details; health details, call summaries, and Social Security numbers still stay in the app.
Social Security numbers, locked down
When a business’s intake asks for a Social Security number, we store it encrypted (AES-256-GCM), show it masked, let only the owner and managers reveal it, log every reveal, and limit that call’s recording to them. It is never in texts, emails, or push notifications.
Recordings only when your plan includes them
Calls are recorded only on Real Talk and Big Talk. Small Talk keeps no recordings.
Masked logs
Our service logs never include request bodies, passwords, tokens, or cookies. Emails and phone numbers are masked, and error logs delete themselves after 7 days.
Health information and HIPAA
Callers often share health information. Every business accepts our Business Associate Agreement (BAA) when it creates its account, and we act as the business associate of HIPAA covered entities and require a business associate agreement from each service provider that handles PHI for us. We never sell health information, use it for marketing, or use it to train AI models.
Security under HIPAA is shared. Our HIPAA page explains what we do and how to set up your account, including the health information question that keeps caller details out of texts, emails, and push notifications.
What we don’t claim
We don’t hold a SOC 2 report, HITRUST certification, or ISO 27001 certification today, and there is no official HIPAA certification for anyone. We don’t publish an uptime guarantee. If any of that changes, we will say so here.
No system is perfectly secure. Use a strong, unique password, give each teammate only the role they need, remove people who leave, and keep your phone locked.
If something goes wrong
If we find a security incident that affects your data, we investigate, contain it, and notify you as the law and our agreements require. For health information covered by our BAA, we report to you as the BAA describes so you can meet your own obligations.
Our notification promisesReport a security issue
Found something that looks like a security problem? Email us with what you found and the steps to reproduce it. Please don’t access other people’s data, and give us a fair chance to fix it before you share it publicly.
Email help@frontdesk.talkRelated policies
Stop paying for voicemail.
Setup takes a few minutes. Cancel anytime.