Security

Last updated: October 31, 2026

This page describes the security and privacy measures built into EvaSay today. The commitments that bind us are in our Terms of Service, Privacy Policy and Data Processing Addendum.

Your account and workspace

• Two-step verification. Protect dashboard sign-in with a code from an authenticator app, with one-time backup codes if you lose your phone. Accounts that sign in with Google, GitHub or Apple are protected by that account's own sign-in.
• Roles. Each workspace member has a role: owner, admin, billing, member or read-only viewer. Billing and read-only members cannot change agents, numbers or settings.
• Activity log. Owners and admins can see who in the workspace changed or deleted an agent, deleted calls, downloaded a recording, changed data settings, created an API key or connected a carrier account, and when.
• Keys. API keys are stored only as hashes and are shown once, when you create them.

Your data

• Encryption. Data travels over TLS between browsers, carriers' media streams, our systems and our providers. Stored data is encrypted at rest by our hosting and storage providers. Carrier, storage and app credentials you give us are additionally encrypted by EvaSay with AES-256-GCM.
• Retention. Choose how long your workspace keeps call content: after the period you set, transcripts, recordings kept in EvaSay's storage, summaries and extracted fields are deleted automatically. Call times, durations and credits stay, so billing and charts are unaffected.
• Agents that keep no content. Set an agent to keep no transcript, recording or analysis of its calls. Only the call's time, length, outcome, number and credits are kept.
• Card numbers masked. Payment card numbers (checked with the Luhn algorithm), IBANs and U.S. Social Security numbers are masked in the transcripts we keep, in summaries and in webhooks. Recordings are not altered, and the agent still hears what the caller says during the call, so do not ask callers for this information.
• Deletion. Delete a single call, or every call with one caller's phone number or your own ID for them, in the dashboard or through the API, with its transcript and recording.
• Recordings in your own storage. Recordings can go straight to your own S3-compatible bucket instead of ours.
• No training on your calls. We do not use your call content to train models, and the language model providers we use do not train on it.
• Where data is kept. The database is in Ireland. Our providers and where they process data are listed on the Subprocessors page.

Calls

• Disclosures. Agents tell callers they are talking to an AI by default, and recording can announce itself, ask for consent first, or stay off.
• Do-not-call list. Numbers on your do-not-call list are never dialed by campaigns.
• Call authorization. Every call runs with a short-lived token. Carriers' callbacks are verified by signature or by a secret specific to your account, and the webhooks we send you are signed.
• Network protection. Requests your agents' functions and webhooks make can only reach public addresses and do not follow redirects. Sign-up and public web calls are protected against automated abuse, and our interfaces are rate-limited.
• Reliability. Speech recognition and language model providers fail over to alternatives, and a standby answers your carrier's calls if our main service does not. Current status is on the status page.

What we do not do

• Payment cards. EvaSay is not PCI DSS certified, and agents must not collect full card numbers. Send the caller a payment link instead.
• Health information. EvaSay does not sign business associate agreements under HIPAA, and agents must not collect health information. Clinic agents should only book appointments.
• Certifications. We do not hold SOC 2 or ISO 27001 certification today.

Reporting a security issue

Email support@evasay.com with "Security" in the subject. Please give us a reasonable time to fix the issue before disclosing it, and do not access other customers' data or disrupt the service while testing.