Security and compliance at CallUltra
Security & compliance
How CallUltra handles your data
Your data is scoped to your account
Every query the platform runs is scoped to the account that owns the data. The scoping helper refuses to build an unscoped query rather than quietly returning everything, so a missing filter fails loudly instead of leaking.
Sessions you can see and revoke
Sign-in issues an httpOnly cookie with a two-hour access token; refresh tokens are hashed before they are stored. You can list every active session with its device, IP and sign-in time, and revoke one or all of the others from your account settings.
What we actually do
Concretely, and without the acronyms:
Two-factor authentication over TOTP, with replay protection arbitrated by the database rather than by a read-then-check.
Role-based permissions that deny by default, an unrecognised role resolves to no permissions at all, never to full access.
Record lookups return the same 404 whether a record is missing or belongs to someone else, so existence is never leaked by the error.
Outbound fetches are checked against private IP ranges and cloud metadata hosts, with a DNS failure treated as unsafe.
Recording playback runs through an ownership-checked proxy, a file streams only if it matches one of your own calls.
We do not currently hold ISO 27001 or SOC 2 certification. When that changes, this page will say so and link the report. We would rather under-claim here than have you find out during procurement.
Recordings, transcripts and who sees them
Calls are recorded only after the callee answers, so ringing is never captured. When you connect a CRM you choose whether transcripts and recordings travel with the synced record or stay on the platform, turn it off and the payload carries the outcome without the conversation.
Product analytics that collect almost nothing
Behavioural analytics run through three independent gates: a closed event list, a per-event property allowlist, and a scrubber that drops, rather than masks, anything that looks like personal data. Money is reported only as a band, never a figure. Session replay masks every input, and consent is a versioned cookie you can revoke in one click.