Security
Your customers’ calls, handled like they’re yours.
Calls carry names, numbers and sometimes more. Here is where that data goes, who can see it, and what you control — everything on this page is something we can show you in the product.
- Your team, in SayliaRecording, transcript, caller number, sourceOnly accounts and roles you grant
- Ad platforms you connectConversion, click ID, hashed caller numberNever the recording or transcript
- Your CRM, by webhookCall details, including caller numberSigned, to an address you set
Nowhere else. We don’t sell call data or use it to advertise Saylia.
Where data goes
Ad platforms learn which calls converted. Not what was said.
Conversion sync is the reason most teams buy Saylia, and the first thing a careful client asks about. Each destination gets what it needs and no more.
- Recordings stay with you
- Recordings and transcripts are never sent to an ad platform. Platforms get the conversion and what they need to match it to a click.
- Links stored without their passengers
- Landing pages and referrers are stored with only their UTM tags, click IDs and the parameters you choose. Give a number pool a parameter list and nothing else in a link, like an email address or a reset token, is kept.
- Hashed where the platform allows
- Caller numbers are put in E.164 format and hashed with SHA-256 for click, enhanced and Meta uploads. Google call-ad conversions match on caller ID, which Google requires unhashed.
- Signed deliveries to your systems
- Every webhook is signed with HMAC-SHA256 using a secret only you and Saylia hold, so your CRM can reject anything that isn’t from us.
- No internal destinations
- Webhook addresses that resolve to a private network are refused before anything is sent.
Who sees it
Each client’s calls stay in their own lane.
Agencies run many clients from one workspace. People see the accounts they’ve been given, at the level they’ve been given — and you can see who changed what.
One client, one account
Calls, numbers, routing and webhooks belong to a single client account. Every lookup is checked against the accounts the person signed in can reach.
Roles for your team and theirs
Admin, editor and viewer, in a version for agency staff and one for clients’ own people. A client login sees that client and nothing else.
Recordings checked on every play
Playback links name the call, not the file, and are signed fresh for each request. Remove someone’s access and the link stops working for them.
API keys that can’t overreach
A key can never carry a permission its creator doesn’t hold, and each key has its own rate limit.
Every change on the record
Changes to numbers, routing, webhooks and users are logged with who made them and when. Secrets are blanked out of the log.
“View as” leaves a trail
When someone views the app as another user to troubleshoot, both names are recorded on every change, and the session ends after eight hours.
Recording and consent
You decide what’s recorded, and what callers hear.
Recording laws differ by state and country, and some require every party to agree. Saylia gives you the controls; you choose how to use them for where you and your callers are.
On by default, off per number
Calls are recorded unless you turn recording off for a tracking number — for example, a line that takes card payments.
A notice before they’re connected
Play a recording announcement to the caller first, in your words or ours.
Only when it’s true
The announcement plays only when the call is actually being recorded, so callers are never told something that isn’t happening.
Under the hood
For whoever reviews vendors on your side.
The controls your IT or security reviewer will look for first.
- TLS 1.2 or 1.3 only
- The app and API refuse older protocol versions.
- Carrier requests verified
- Call events from the phone network must carry a valid signature or credentials, or Saylia refuses them.
- Credentials kept out of logs
- Authentication headers are removed from carrier request logs before they are written.
- Safe exports
- CSV exports neutralize cells a spreadsheet would otherwise run as a formula.
- Secret scanning
- Code is scanned for keys and passwords in continuous integration and before every commit.
Plan around this
What we don’t offer yet.
Saylia doesn’t hold a SOC 2 report or sign HIPAA business associate agreements today, and it doesn’t remove card numbers from recordings. If your review requires any of these, or you take payments by phone, tell us at the start — we’d rather you know now than in week three.
Security review
Send us your questionnaire.
Vendor forms, a question about one control, or a vulnerability to report: write to security@saylia.com and someone who knows the system answers.
See for yourself what leaves Saylia.
Get started and follow a call from the ad click to the conversion your platform receives, field by field.