Recording calls is serious. We treat it that way.
A consent line plays before anything is captured, in your own words. Opt-outs are honored automatically. And the AI never speaks to a customer unless you turn it on — the safe setting is the default.
Nothing writes from the browser
Every change goes through the server. Client-side writes are denied outright.
Your keys, encrypted
AES-256-GCM with a fresh IV and auth tag, validated per provider.
Signed telephony
Webhook signatures verified in production so nobody can fake a call into your account.
311 tests, 25 suites
Plus an end-to-end run from webhook to database on every deploy.
Fail-safe defaults
Listen-only unless flipped; a calendar outage never blocks a booking.
One tenant can't see another
Reads are gated on your organization, top to bottom.
The boring answers, written down before you ask
TLS in transit, AES-256-GCM at rest with a fresh IV and auth tag per record. Provider keys are validated per vendor and never leave the server.
Every read is gated on your organisation from the query up. One account cannot see another's conversations, records or numbers by construction, not by filter.
A disclosure line in your own wording plays before capture, consent is tracked per customer, opt-outs are honoured automatically and marketing messages are blocked outside legal hours.
Conversation data belongs to your tenancy. It is not pooled, not sold, and not used to train models that serve anyone else.
Every conversation, agent action and admin change is logged and queryable, so you can show exactly what was said and done on your behalf.
Records export in full and delete on request. Leaving should cost you a support ticket, not a quarter.
Formal certification status is stated on request rather than implied by a badge on a marketing page. If you need a questionnaire answered, ask and we will tell you plainly what we hold today and what we do not.
Need our security questionnaire answered?
Email security@kaboota.cloudmantra.ai — we answer it plainly, including the rows where the answer is not yet.
Straight answers
A disclosure line plays before capture in your own wording, consent is tracked per customer, opt-outs are honored automatically, and marketing messages are blocked outside legal hours. Your attorney will find it boring, which is the goal.