Security

1. Where your data lives

• The database, logins and file storage run on Supabase in London, UK. Transcripts and all workspace data are stored there.
• The application servers run on Fly.io in Frankfurt, Germany, close to the database.
• Live call audio is streamed to the voice model and is not kept by Sawt. What we keep is the transcript.
• Need regional hosting for a regulatory reason? Ask about Enterprise.

2. Keeping workspaces apart

• Every table is protected by database row-level security, so one workspace's data cannot be read by another. An automated test fails the build if a table is ever added without it.
• Team members get roles, and API keys are limited to the permissions you give them.
• Website visitors are identified by a one-way hash, never by an identifier they choose, so a visitor cannot pose as another customer.

3. Encryption and secrets

• All traffic uses TLS: the website, the API, and the live call connection.
• Data at rest is encrypted by our database provider.
• Passwords and tokens for the tools you connect (calendars, CRMs) are encrypted again with AES-256-GCM before they are stored.
• Webhooks we send you are signed with HMAC-SHA256, so you can check they came from us.
• Card details never reach Sawt. Payments are handled by Dodo Payments, our merchant of record.

4. Retention and recordings

• Call and chat records are deleted automatically after 12 months, or sooner if you set a shorter period.
• Call recording is off unless you switch it on for an agent. Recordings follow the same deletion schedule.
• To delete your account and its data, see Data Deletion.

5. How we run the service

• Access to our own admin console requires a second factor from an authenticator app.
• Links you give the agent to read (websites, webhooks) are checked before we fetch them, so they cannot be used to reach our internal network.
• Requests are rate-limited, and important account actions are written to an audit log.
• Errors are monitored, and the service is health-checked from outside every 15 minutes.

6. Certifications

Sawt is a young company and does not hold SOC 2 or ISO 27001 certification yet. Our infrastructure providers (Supabase, Vercel, Fly.io and Google Cloud) are independently audited. If your company needs a security questionnaire answered or a data processing agreement signed, email ahmad.nassar@sawtai.app.

The full list of providers that process data for us is in the Privacy Policy.

7. Reporting a security issue

If you think you have found a vulnerability, email ahmad.nassar@sawtai.app. Please give us a reasonable chance to fix it before telling anyone else. We reply to every report.