Built to protect your business.

AlwaysRespond runs on Vercel (SOC 2 Type II) for compute and Neon Postgres (SOC 2 Type II) for primary storage. Both providers maintain independent security programs with annual third-party audits.

Voice pipelines route through Telnyx (SOC 2 Type II) for call handling and SMS delivery. All providers process data under signed Data Processing Agreements.

Infrastructure logs and application metrics are retained for 90 days. Access is restricted to on-call engineers and requires an authenticated session with MFA.

We do not sell, rent, or share your data with third parties for advertising or analytics.

Only your team can see your calls and customers. Every request is checked against your account, and an automated check on every release looks for any page that skips it.

Within each account, role-based access control (RBAC) limits what each user can do:

• Owner: full access including billing and team management
• Admin: full operational access, no billing
• Agent: calls, bookings, and jobs; no settings
• Technician: assigned jobs only
• Viewer: read only

Two-factor authentication (2FA) is available to every user via TOTP authenticator apps, with backup codes. Each person turns it on for themselves.

AlwaysRespond employees never access tenant data unless explicitly invited as a team member or in response to a support ticket you opened. Internal access is logged and audited quarterly.

AlwaysRespond never stores credit card numbers, CVVs, or full payment account details on our servers. All payment data flows directly through Stripe, which holds PCI DSS Level 1 certification, the highest level available.

Card details are tokenized inside Stripe's environment before reaching our application. We store only the Stripe Customer ID and payment method fingerprint for display purposes.

Invoices generated through the AlwaysRespond platform and collected via our payment links are also processed through Stripe Connect. Your customers' card data never touches AlwaysRespond servers.

AlwaysRespond does not store call audio. Calls are transcribed in real time, and the transcript and AI summary are stored in our primary database: Neon Postgres, US region, encrypted at rest. Only authenticated members of the owning account can read them.

If you close your AlwaysRespond account, your call data is purged within 30 days.

Some jurisdictions treat live call transcription like call recording for consent purposes. You are responsible for ensuring your greeting and disclosure language meets the requirements in your jurisdiction.

AlwaysRespond operates as a registered 10DLC message originator in the United States. Our brand and campaigns are registered with The Campaign Registry (TCR), a requirement for commercial messaging through all U.S. carriers.

STOP and HELP keywords are handled automatically at the messaging layer. Opt-outs are honored immediately and propagated across all outbound SMS flows within your account.

AlwaysRespond maintains a consent ledger for every contact: when consent was captured, through which channel, and what message category was agreed to. Messages are never sent to contacts who have opted out or who have not provided consent for the relevant message type.

You are responsible for collecting and recording valid TCPA consent from contacts before using AlwaysRespond to message them. Our SMS compliance settings page includes opt-in language templates that meet common legal standards.

AlwaysRespond acts as a data processor for the personal data of your customers. You remain the data controller. Our Privacy Policy and Data Processing Agreement (DPA) describe how we handle personal data on your behalf.

For GDPR-regulated accounts: you can request a full export of all personal data we hold for your account and your contacts at any time by emailing privacy@alwaysrespond.com. Deletion requests are completed within 30 days.

For CCPA-regulated accounts: California residents can request to know, delete, or opt out of the sale of their personal information. AlwaysRespond does not sell personal data. Requests can be submitted to the same address above.

AlwaysRespond maintains a written incident response plan reviewed and updated annually. If a security incident results in unauthorized access to personal data, affected customers will be notified within 72 hours of our confirmation, consistent with GDPR Article 33 timelines.

Notification will include: what data was affected, how the breach occurred (once determined), what we have done to contain it, and steps you should take to protect your account.

Live service health and recent incidents are on our status page. Incident updates also go out by email to account owners, and you can always reach a person at support@alwaysrespond.com.

If you believe you have found a security vulnerability in AlwaysRespond, please report it to security@alwaysrespond.com. Include a description of the issue, reproduction steps, and any relevant screenshots or logs.

We commit to:

• Acknowledging your report within 48 hours
• Providing a status update within 7 business days
• Not pursuing legal action against researchers who follow responsible disclosure practices
• Crediting researchers in our changelog when a fix ships (with your permission)

Please do not publicly disclose the issue until we have confirmed a fix is in place.