Security
KwikCall is built for production voice workloads. Below is what we operate today, what we are hardening, and how to reach us for incidents.
Trust matrix
| Area | Control | Status |
|---|---|---|
| Transport | HTTPS, TLS 1.2+, HSTS, security headers on public hosts | Live |
| Auth | bcrypt passwords, JWT access/refresh, login rate limits, role checks | Live |
| Tenant isolation | Org-scoped APIs for agents, contacts, calls, billing | Live |
| Secrets | Integration secrets Fernet-encrypted at rest; `.env` mode 600 on app host | Live |
| Admin surface | Superadmin routes require elevated auth; OpenAPI disabled in production | Live |
| Backups | Nightly DB dump + deploy-time file backups before major changes | Live |
| Data residency | Primary production currently Azure India (Central India VM) | Documented |
| Payments | Stripe processor; no full card PAN stored by KwikCall | Scaffolded / gated |
| SSO / SOC2 pack | Enterprise paperwork & IdP SSO | Roadmap |
Data residency
Application, Postgres, and Redis for the live stack run on our Azure India VM. Cloudflare terminates edge TLS. Recordings and transcripts stay in the tenant’s workspace subject to retention settings.
Incident response
- Report suspected vulnerabilities or incidents to support@kwikcall.ai with steps to reproduce.
- We acknowledge security reports within 2 business days and prioritize confirmed issues.
- Please avoid public disclosure until we confirm a fix or mitigating control.
We do not display invented ISO/SOC badges. When third-party audits complete, we will publish the report summaries here.