Control
Organization isolation
Every workspace is a separate organization. Users, numbers, calls, messages, and files are scoped to it, and API credentials belong to one organization.
Trust
Trust starts with clear boundaries.
What Callfora does to protect your organization's data, where it lives, and how to reach us about security.
Control
Encryption
Traffic to the website, application, and API uses TLS. Stored credentials and integration secrets are encrypted at the application layer.
Control
Access control
Roles and permissions control who can administer users, numbers, recordings, and billing. API keys are scoped, can expire, and can be restricted by IP range.
Control
Audit and traceability
Administrative and API activity is logged with request IDs. Webhook deliveries can be inspected and replayed.
Control
Data location
The application and its data are hosted on Oracle Cloud Infrastructure in India. Carriers and some providers process data elsewhere; see Subprocessors.
Control
Sandbox separation
Sandbox API credentials can only reach sandbox organizations, and live credentials cannot read sandbox data.
Security contact
Report a vulnerability
Email security@callfora.com with details and steps to reproduce. Please give us reasonable time to fix the issue before disclosing it, and do not access other customers' data. See /.well-known/security.txt.
Agreement
Data processing addendum
Our DPA applies automatically to personal data we process for you. Ask sales for a countersigned copy.
Read the DPA →Processing
Subprocessors
The providers we use to run the service, what they do, and where they process data.
View subprocessors →Privacy
Privacy policy
What we collect, why, how long we keep it, and your rights.
Read the policy →Calling
Emergency calling
Important limitations of emergency calling on internet-based phone service.
Read the notice →Regions
Compliance by region
How we approach privacy, messaging, calling, and AI rules in India, the US, the EU, the UK, and other regions.
See regions →Security
Vulnerability disclosure
How to report a security issue and the safe-harbor commitments we make to researchers.
Report an issue →Questionnaires
Security reviews
We answer security questionnaires for customers in procurement. We do not currently hold third-party certifications.
Contact us →Procurement and security
Bring us the difficult questions.
We can review data flow, access, retention, subprocessors, and the controls that apply to your rollout.