Security
Security and privacy you can explain to your customers
Your callers trust you with their details. Here's how we protect them, in plain English.
Encryption
- All traffic to and from our app, our phone provider and our AI providers uses TLS (HTTPS).
- Data is encrypted at rest by our database and hosting providers.
- Calendar tokens, provider credentials and webhook secrets get a second layer of AES-256-GCM encryption before they're stored.
- Secrets are never sent to your browser or written to logs.
Access control
- Every business is fully separated: your team can only see your business's calls, contacts and settings.
- Owner, admin and member roles control who can change your agent, billing and team.
- Two-factor authentication (authenticator app) is available to every user.
- Sensitive actions, like going live, forwarding changes, voice consent and team changes, are recorded in an audit log.
Honest AI, by default
- Your agent introduces itself as an AI assistant on every call and never claims to be human, even in your own voice.
- It only shares facts you approved and takes a message instead of guessing.
- Built-in protections against callers trying to trick the agent into ignoring its instructions.
Consent & recording disclosure
- Callers hear that the call is recorded and transcribed at the start of the call. This is on by default.
- Text messages honor STOP and other opt-out words immediately, and HELP replies with your contact details.
- Outbound sales calls (add-on) require a consent record for every lead and respect do-not-call lists and state calling hours.
- Voice cloning requires the account owner's signed consent and a live spoken confirmation of a one-time phrase.
Retention & deletion
- You choose how long call recordings and transcripts are kept. Older ones are deleted automatically.
- Voice clone data is deleted within 30 days after you turn it off, as described in our Voice Cloning policy.
- When you close your account, your data is deleted on a set schedule, except records we must keep by law (like consent and opt-out records).
- You can ask us to delete your data at any time.
Your data stays yours
- We never sell your data or your callers' data.
- We don't use your calls to train AI models for other businesses.
- Our AI providers process data only to deliver the service, under their business terms.
Subprocessors
The companies that help us run the service
We use a small number of established providers, each under a written agreement that limits how they use data.
| Provider | What it does for us | Data involved |
|---|---|---|
| Twilio | Phone numbers, call routing, call recording and text messages | Phone numbers, call audio, text messages |
| ElevenLabs | Real-time voice conversation and voice generation; voice cloning (add-on) | Call audio, transcripts, voice samples (if you use Your Own Voice) |
| Anthropic | AI language model for text conversations, call summaries and setup help | Transcripts, messages, business information |
| Stripe | Subscription billing and payments | Billing contact and payment details (we never see full card numbers) |
| Resend | Transactional email: alerts, summaries, account emails | Email addresses, alert contents |
| Vercel | Application hosting | All application data in transit |
| Neon | Managed Postgres database | Account data, call records, contacts, settings |
If you connect Google Calendar or Microsoft Outlook, we access them through your own account with the permissions you approve.
Health information
We don't sign HIPAA Business Associate Agreements yet. Your agent avoids collecting medical details and won't give medical advice. HIPAA covered entities should contact us before using Frontwren with patient information.
Legal documents
Read our Privacy Policy, Data Processing Addendum and Voice Cloning & Biometric Policy.
Report a security issue
Found a vulnerability? Email support@frontwren.com with "Security report" in the subject. We'll respond quickly and keep you updated.
This page describes our current practices and may change as we improve the service.
Stop sending customers to voicemail
Join the early-access list. Founding members: your first month free and today's price locked in for 12 months.