Security
Security and trust.
Your phone system holds recordings, transcripts, messages and your customers' details. This page says where that data lives, who else touches it, and what we do and do not have. We would rather list a gap than imply a certification we have not earned.
How your data is protected
Hard tenant isolation
Every table holding customer data runs Postgres row-level security in FORCE mode. The only path to a row is a transaction opened for one organization, which means a cross-tenant read is not reachable even from our own application code — not a rule we remember to apply, a rule the database enforces.
Encryption in transit and at rest
TLS on every external connection. The database, and the object storage holding recordings, transcripts and backups, are encrypted at rest by the platforms that host them. Recordings are served through short-lived signed URLs, never a public bucket.
Passkeys and required MFA
Every user can sign in with a passkey or an authenticator app. An organization can require MFA for everyone, with a grace period for people to enrol, or a strict policy with none.
Roles and audit
Built-in roles, plus custom roles you build from 51 permissions grouped by area. An API key belongs to a person rather than to one organization, and reaches whatever that person can reach: tokens are bcrypt-hashed at rest, shown once and never again, optionally set to expire, and revocable at any time, and a leaked key cannot mint another because only a signed-in browser session can create one. Sensitive actions are recorded in an audit log you can read from your own settings — onboarding, text sends, AI agent setup and tests, offboarding, and the admin actions we take on your account for billing, tax and onboarding — with request bodies redacted at write time.
Caller ID and call signing
Outbound caller ID must be a number your organization actually owns, checked on every path that can originate a call. Calls are signed for STIR/SHAKEN at the carrier so they are less likely to arrive as "Spam Likely".
Consent, opt-out and retention
Recording and AI disclosures are played from a locked template and the proof is written to an append-only ledger. A STOP suppresses the number in both the consent ledger and the messaging store, and survives the account it was given to. You set your own retention windows for recordings, transcripts and messages; the purge deletes the stored file before the row.
Recording controls
You choose which calls are recorded, for the whole account, an extension or a queue, and separately for AI and human calls, with a pause a flow can drop in before a card number is read out. A recording is kept only once the caller has heard that the call is recorded.
Backups
The database is dumped nightly, encrypted, to object storage, and a dead-man’s switch pages the founder if no backup newer than 26 hours exists. We monitor backup freshness; we do not run scheduled restore drills, and we will not claim we do.
Where it runs
The console, the API and the background workers run on Railway, alongside the Postgres database that holds your account, contacts, call records and messages. Recordings, transcripts and nightly database backups live in Cloudflare R2 object storage.
Call control is ours. The software that answers, routes and bridges a call runs on servers we operate at Hetzner, and the audio terminates there, not in a third-party call platform. Telnyx is the carrier of record for numbers, SIP trunking, texting and 911, and does not touch call routing.
All of it is hosted in the United States. We are a US company, and we do not currently offer data residency in another region.
Subprocessors
Every vendor that can touch customer data. The AI list is read live from the same internal registry our platform admin maintains, so it cannot drift from what we actually run.
Infrastructure and carrier
| Vendor | What it does | Region |
|---|---|---|
| Telnyx | Carrier of record — phone numbers, SIP trunking, SMS and MMS delivery, 911 routing, call signing | United States |
| Railway | Hosting for the application, the background workers and the Postgres database, and the service logs we operate it from | United States |
| Hetzner | Servers running our own call platform, where call audio terminates | United States |
| Cloudflare | R2 object storage for recordings, transcripts and backups; CDN and DDoS protection for the website | United States |
| Stripe | Payment processing and invoicing | United States, EU |
| Resend | Transactional email — invoices, voicemail notifications, alerts | United States |
| Google (Firebase Cloud Messaging) | Push notifications to the Hey Quad mobile app — incoming-call alerts with the caller’s number and name, and notifications such as new voicemail and email | Global |
Speech and AI
These vendors see call audio, transcripts, or the text of a conversation. A text-to-speech vendor speaks your call flow’s prompts, and a speech-to-text vendor hears a caller’s spoken answer when a flow asks for one. The others receive data only when you use an AI feature, such as the AI receptionist, voicemail transcription or AI help in the inbox.
| Vendor | What it does | Region |
|---|---|---|
| Groq | Speech-to-text transcription | United States |
| Groq | Text-to-speech voice | United States |
| OpenAI | Knowledge-base embeddings and search | United States |
| OpenAI | Real-time AI voice conversation | United States |
| OpenAI | Speech-to-text transcription | United States |
| OpenAI | Text AI: call summaries, email triage and drafts, voicemail triage | United States |
| OpenAI | Text-to-speech voice | United States |
Agreements and certifications
Business Associate Agreement. If you handle protected health information, there is a real BAA and you accept it yourself during onboarding. Healthcare accounts stay blocked from going live until every vendor in the chain above is covered, which is a gate we enforce in code rather than a promise.
Call signing and message registration. Outbound calls are signed for STIR/SHAKEN by our carrier. Business texting requires carrier brand and campaign registration, and we guide you through it before your first text goes out.
911. Every number has a registered 911 address, set per location, so an emergency call carries where you are. Calling 911 from an internet phone still works differently from a landline: what it does and does not do, and what you need to tell us, is in our 911 disclosure.
What we do not have. No SOC 2 report and no audit under way. No ISO 27001. No separate data processing addendum beyond the terms in our Privacy Policy. If your procurement process needs any of those, tell us before you buy rather than after; we would rather lose the deal than be vague about it.
Our Terms of Service and Privacy Policy are versioned, and we record exactly which version each account agreed to and when.
Found a vulnerability?
We welcome responsible disclosure. Email security@heyquad.com with reproduction steps. We respond within two business days and credit researchers, with permission, on this page.