How Ringkit protects your calls and your data.

Encryption

Your business brief, call recordings and summaries are encrypted at rest and in transit.

• In transit: TLS 1.2 or higher for the API, the dashboard and webhook deliveries.
• At rest: AES-256 for recordings, transcripts, summaries and briefs.
• Encryption keys are managed separately from the data they protect, and access to them is restricted.

Access control

• Reps see only your brief and the live call — not your account, billing or call history.
• Every access to customer data by Ringkit staff or reps is logged.
• API keys are scoped by environment — rk_live_ for production, rk_test_ for testing — and you can rotate them any time.
• Webhooks are signed with HMAC-SHA256 so your server can verify every event came from Ringkit.

Call recording & consent

Calls are recorded and transcribed to make the summary. Ringkit plays a consent notice on every call and follows two-party-consent rules by state.

You stay responsible for recording lawfully in your business and industry. See section 5 of our Terms.

Data handling & model use

Your business brief, call recordings and summaries are encrypted at rest and in transit, and never used to train models for anyone else. The AI providers we use are bound by terms that bar training on your data.

• Recordings are kept 90 days by default; you can change that in settings.
• Transcripts and summaries are kept until you delete them.
• Delete any call, or export everything, whenever you want. See our Privacy Policy.

Reliability

Calls run on redundant carrier routes in multiple US regions. Status page and incident history are public.

• If one carrier route fails, calls move to another.
• Call handling runs in more than one region, so a regional outage doesn't take your line down.
• Follow incidents as they happen on the status page.

Number porting

Keep your existing number. Porting is free and takes 3–10 business days with most US carriers; your old line keeps working until the port completes.

Your number stays yours. If you leave, you can port it out to another provider and we'll release it promptly.

Responsible disclosure

Found a vulnerability? Email security@ringkit.ai with steps to reproduce. We'll acknowledge your report, keep you updated while we fix it, and credit you if you'd like.

• Don't access or change other customers' data.
• Don't degrade the service or place calls to real people while testing.
• Give us reasonable time to fix the issue before you disclose it.

Roadmap

We'd rather be clear about what isn't done yet.

• Independent security audit — planned before general availability.
• Single sign-on (SSO) — planned.
• Audit-log export — planned, so you can pull access logs into your own tools.
• Named subprocessor list — to be published alongside the Privacy Policy.