Data Security Policy

This policy describes how Calilio protects the data customers trust us with. It is written to be checked, not admired, so it describes controls rather than intentions.

It sits alongside our Data Processing Agreement, whose Annex II lists the technical and organisational measures we commit to contractually.

1. How your data is protected

In transit

• All connections between your browser, the mobile apps and our servers use current industry-standard encryption.
• Voice traffic is carried over encrypted signalling to our carrier partners.
• Administrative access to our systems is only possible over encrypted channels.

At rest

• Databases, file storage and backups are encrypted using our hosting provider's storage encryption.
• Call recordings, voicemail and message attachments are stored in encrypted object storage with access restricted to the service.
• Payment card numbers never reach Calilio's systems. Card entry happens directly with our payment providers.

Who can reach your data

• Access is role-based and follows least privilege: a person gets the minimum access their job needs.
• Every member of staff uses a named individual account. Shared logins are not permitted.
• Multi-factor authentication is required for staff access to production systems.
• Access is reviewed when a role changes and removed the day someone leaves.
• Administrative actions are logged, and logs are retained for 12 months.

2. Protecting your account

We give you the controls and we recommend you use all of them.

• Multi-factor authentication is available to every account. Turn it on.
• Device recognition lets you keep a trusted device signed in and flags a new one.
• Session expiry ends idle sessions automatically.
• Role-based permissions let you give each team member only what they need.
• Password requirements enforce a minimum strength, and we reject passwords known to have appeared in public breaches.

Your part matters. Most account compromises we see start with a reused password or a phishing email, not with a flaw in the service.

3. Keeping the platform safe from abuse

A phone system is a target because phone calls cost money. These controls exist to stop fraud being run through your account at your expense.

• Fraud scoring on new accounts, using signals such as identity verification results, the number of numbers requested, whether the card name matches the account name, and the countries involved.
• Device fingerprinting at sign-up, which detects one person opening many accounts.
• Rate limits on accounts that have not completed identity checks. Our Acceptable Use Policy states them.
• Blocking of abusive addresses, email domains and numbers.
• Bot protection on public forms.
• Monitoring for unusual calling patterns, particularly traffic to destinations associated with call fraud.

4. How we build

• Code is reviewed by a second engineer before it reaches production.
• Development, staging and production run in separate environments with separate credentials.
• Dependencies are scanned for known vulnerabilities and updated on a regular cycle.
• Production access is limited to the engineers who need it, and is logged.
• Changes are released through an automated pipeline, so a change can be traced and reversed.

5. Resilience and continuity

• Data is replicated within the hosting region.
• Backups run on a regular schedule, and restore procedures are documented and tested.
• Our hosting provider operates across multiple availability zones, so a single data-centre failure does not take the service down.
• We do not publish an uptime commitment. Where a contract requires one, talk to us before you sign.

6. If something goes wrong

We run a documented incident process covering detection, containment, assessment, notification and review.

• We tell affected customers without undue delay, and within 48 hours of confirming a personal data breach that affects their data.
• We notify the Personal Data Protection Commission no later than 3 calendar days after assessing that a breach is notifiable, where Calilio is the controller.
• We write up every significant incident afterwards, identify the cause, and fix it.
• Our Data Processing Agreement sets out exactly what a breach notification contains.

7. Certifications: a straight answer

Security certifications are audits. An outside firm checks a company's controls and issues a report. The two that buyers usually ask about are ISO 27001, an international standard for running an information security programme, and SOC 2, a report on how well a company's controls actually operated over a period of time.

Calilio does not currently hold ISO 27001 or SOC 2, and we do not claim to. Here is what is true instead:

• Our infrastructure provider holds both, along with the other major certifications, for the data centres and platform services Calilio is built on. That covers the foundation we run on. It does not cover Calilio's own processes, and we will not present it as if it did.
• Our controls are written down and checkable. This policy describes them, and Annex II of our Data Processing Agreement commits to them contractually. That is a real obligation, not a marketing claim.
• We answer security questionnaires in full, and we will take your security team through any control on this page.
• We will never claim a certification we do not hold. If any page on our website suggests otherwise, tell us at security@calilio.com and we will correct it that week.

If your procurement process requires a specific certification or audit report before you can buy, write to security@calilio.com and ask. We will tell you exactly where we stand before you spend time on an evaluation.

8. Reporting a vulnerability

9. Your responsibilities

Security is shared. We secure the platform. You secure your use of it.

• Turn on multi-factor authentication for every user.
• Use unique passwords and a password manager.
• Remove users the day they leave.
• Review who has administrator rights regularly.
• Set call recording, retention and sharing settings deliberately, not by default.
• Tell us immediately at security@calilio.com if you think an account has been compromised.

10. Changes to this policy

We update this policy as our controls change. The date at the top shows the current version. Material changes are announced to customers.

11. How to contact us