Legal
Security Overview
The controls used to protect Call Bullet accounts, communications and workspace data.
Last updated: 8 October 2026
1. Security model
Call Bullet applies layered controls proportionate to a multi-workspace communications service. No overview or control can guarantee that an internet service will never experience an incident.
2. Identity and access
- Authenticated, role-based access with workspace boundaries.
- Administrative access restricted to authorised operational needs.
- Scoped API permissions, hash-only API-key storage and deactivation rather than secret recovery.
- Device and account controls for sessions and notifications.
3. Data protection
- Encryption in transit and at rest through managed infrastructure.
- Private storage and authorised access for sensitive documents and communications content.
- Secrets kept outside public application code and restricted by service role.
- Backup, recovery and retention controls appropriate to the service category.
4. Application and operations
- Audit and delivery evidence for important call, SMS, billing and account activity.
- Input validation, rate and spend controls, consent and suppression checks where supported by the product.
- Dependency and application review, monitored service errors and controlled deployment processes.
- Incident investigation and customer notification under the Data Processing Addendum and applicable law.
5. Customer responsibilities
Use unique sign-in credentials, protect API keys, grant the least access needed, remove departed users, keep devices and integrations patched, review usage and report unexpected activity. Never place a secret in browser code, an AI prompt, a support screenshot or a public repository.
6. Reporting a concern
Send a concise report to info@callbullet.com with the affected page or service, time, steps and impact. Do not access, download, alter or disclose another person’s data to prove a concern. We will acknowledge and triage responsible reports and may ask for a secure exchange channel.
7. Claims and assurance
This overview describes implemented practices at a high level. It does not claim a certification, audit opinion, penetration-test result, regulatory approval or service-level commitment unless a separate current document expressly provides it.