Security and control
AI that works with guardrails.
The point is not that the AI is careful. It is that the most damaging things are not available to it — decided outside the model, from your configuration, every time.
01
Keeping businesses apart
Every record belongs to one business
Ownership is carried on the record itself and enforced by the database, not only by application code — so a query that forgets to filter returns nothing rather than somebody else’s customers.
Never from what the browser sent
Which business you are acting in is resolved from who you are signed in as. A business identifier supplied by a client is not trusted anywhere.
Tested as a matrix, not as a spot check
Cross-business access is tested over every kind of record, generated from the list of them, so a new kind of record that nobody wrote a test for fails the build.
Background work is scoped too
Jobs running without a person present carry a scoped identity of their own rather than acting as an administrator.
02
What the AI may and may not do
Four categories, decided outside the model
Every action is allowed, allowed only with a recorded confirmation, reserved for a person, or never available at all. Which one applies is evaluated from your configuration every time, not judged by the AI.
A floor no configuration can lower
Unrestricted financial actions, unrestricted data export, access to credentials and arbitrary outbound requests are permanently off the AI surface. You can make your policy stricter; nobody can make it looser.
Tools follow what you switched on
A capability you have not activated does not exist as far as the AI is concerned — the tool is never offered to it, so it cannot be argued into using one.
Confirmation before the effect
Where an action needs agreement, the agreement is recorded before the thing happens, never inferred from the conversation afterwards.
03
What is recorded, and what is not
Everything the AI did is on the record
Each conversation, each action and each handoff is recorded against the customer with what happened, when, and who or what did it.
Recording is a decision, not a default
Whether call audio is kept at all is switched on per business rather than assumed.
Credentials are referenced, never shown
The platform stores references to your provider credentials, not their values, and no screen in the product renders a field that could hold one.
Sensitive operations leave an audit trail
Who did it, when, and under which version of your configuration — appended, never edited. A reversal is a new entry.
04
Standing up to the outside world
Callbacks are verified before they are read
A webhook from a provider is signature-checked, timestamp-checked and de-duplicated before its contents are parsed at all, and one that fails is refused and shown to you rather than silently dropped.
Approving from a message is a real authorisation
A tap on Approve in a message is authorised by a single-use token bound to that request, that recipient and that decision — never by the phone number it arrived from, which is spoofable and travels with a forwarded message.
Only approve and reject travel that far
Cancellations, refunds and anything on the permanent floor are not actionable from a message at all. Those need the dashboard, where the person is properly signed in and can see what they are doing.
Acting twice has no second effect
Decisions are idempotent. The first one wins and a replayed message changes nothing.
Consent and the customer
The person on the other end
Your customers did not sign up for this — you did. Three things follow from that.
They can always reach a person
Asking for somebody is always honoured, and every escalation path ends with a person holding a task or the customer holding a commitment. There is no loop to be stuck in.
They are not messaged into the ground
A central limit on how often any one customer is contacted applies across everything running at once, and quiet hours are respected by all of it.
What is kept about them is visible to you
Consent, contact preferences and history sit on the customer record where you can see and change them.
What is deliberately not claimed
- No certification badges. The product has not been audited against SOC 2, ISO 27001 or any similar standard, so no logo saying otherwise appears anywhere on this site.
- No uptime figure. A percentage published before there is a measured history behind it is a decoration.
- No claim that the AI cannot be wrong. It can. What the design does is keep the expensive mistakes unavailable to it, and make every mistake visible and correctable rather than silent.
- No response-time guarantee on a call. What a call sounds like depends on the line, the room and the providers configured for your account.
If your security review needs answers this page does not give, ask before you commit rather than after. The absence above is the point of it.
Questions
Security questions
Not here? The full list — nothing on this site needs a conversation to find out.
Is my business data kept separate from other businesses?
Yes. Every record in AutoCallDesk belongs to exactly one business and carries that ownership at the database level, enforced by the database itself rather than only by application code. Access is resolved from who you are signed in as, never from anything a browser sends. Cross-business access is tested as a matrix over every kind of record, so an untested one fails the build rather than shipping.
Are the credentials I connect protected?
AutoCallDesk stores credential references rather than credential values, and no screen in the product renders a secret because no screen has one to render. Provider callbacks are refused unless they can prove where they came from, over the exact bytes that arrived, and refused callbacks are visible to you rather than failing silently. No security certification is claimed — none has been undertaken.
Give your business an AI employee.
Start with one job. Add more when you need them. Nothing goes live until you say so.
Or talk to a person first.