Built to protect your business.

All traffic between your browser (or our mobile app) and AlwaysRespond servers travels over TLS 1.3. Older protocol versions are rejected at the edge.

The database itself is encrypted at rest with AES-256 by Neon, our managed Postgres provider, and the keys are theirs rather than ours. That protects the stored volume. Being precise about what it does not do: it is not per-field encryption. OAuth tokens, integration credentials, call transcripts and SMS bodies are readable to anything holding a valid database connection.

One category is encrypted by us, in the application, before it is written: two-factor authentication secrets, with AES-256-GCM. If your procurement review needs field-level encryption on a broader set than that, tell us which fields and we will tell you honestly whether we do it today.

Access to raw conversation data is scoped to the owning tenant and to authorized AlwaysRespond engineers on a break-glass basis.

AlwaysRespond runs on Vercel (SOC 2 Type II) for compute and Neon Postgres (SOC 2 Type II) for primary storage. Both providers maintain independent security programs with annual third-party audits.

Voice pipelines route through Telnyx (SOC 2 Type II) for call handling and SMS delivery. All providers process data under signed Data Processing Agreements.

Infrastructure logs and application metrics are retained for 90 days. Access is restricted to on-call engineers and requires an authenticated session with MFA.

We do not sell, rent, or share tenant data with third parties for advertising or analytics purposes.

Every request that reads tenant data is scoped to the tenant on the session. Roughly a third of those routes go through a database client that injects the tenant filter automatically, so it cannot be omitted; the rest state the filter in the query itself. An automated check runs on every build and fails if a table carrying tenant data is missing from the automatic set, or if a route that should be scoped is not.

Being precise, in the same spirit as the encryption section above: this is enforced on every path we ship and tested on every build, but it is not a single structural guarantee that would hold for a route written incorrectly tomorrow. If your review needs that distinction documented, ask and we will walk you through exactly which surfaces use which.

Within each account, role-based access control (RBAC) limits what each user can do:

• Owner - full access including billing and team management
• Admin - full operational access, no billing
• Agent - calls, bookings, and jobs; no settings
• Technician - assigned jobs only
• Viewer - read only

Two-factor authentication (2FA) is available to every user via TOTP authenticator apps, with backup codes. Each person turns it on for themselves; there is not yet an account-wide setting that requires it of everyone.

AlwaysRespond employees never access tenant data unless explicitly invited as a team member or in response to a support ticket you opened. Internal access is logged and audited quarterly.

AlwaysRespond never stores credit card numbers, CVVs, or full payment account details on our servers. All payment data flows directly through Stripe, which holds PCI DSS Level 1 certification, the highest level available.

Card details are tokenized inside Stripe's environment before reaching our application. We store only the Stripe Customer ID and payment method fingerprint for display purposes.

Invoices generated through the AlwaysRespond platform and collected via our payment links are also processed through Stripe Connect. Your customers' card data never touches AlwaysRespond servers.

AlwaysRespond does not store call audio. Calls are transcribed in real time, and the transcript and AI summary are stored in our primary database: Neon Postgres, US region, encrypted at rest. Only authenticated members of the owning account can read them.

If you close your AlwaysRespond account, your call data is purged within 30 days.

Some jurisdictions treat live call transcription like call recording for consent purposes. You are responsible for ensuring your greeting and disclosure language meets the requirements in your jurisdiction.

AlwaysRespond operates as a registered 10DLC message originator in the United States. Our brand and campaigns are registered with The Campaign Registry (TCR), a requirement for commercial messaging through all U.S. carriers.

STOP and HELP keywords are handled automatically at the messaging layer. Opt-outs are honored immediately and propagated across all outbound SMS flows within your account.

AlwaysRespond maintains a consent ledger for every contact: when consent was captured, through which channel, and what message category was agreed to. Messages are never sent to contacts who have opted out or who have not provided consent for the relevant message type.

You are responsible for collecting and recording valid TCPA consent from contacts before using AlwaysRespond to message them. Our SMS compliance settings page includes opt-in language templates that meet common legal standards.

AlwaysRespond acts as a data processor for the personal data of your customers. You remain the data controller. Our Privacy Policy and Data Processing Agreement (DPA) describe how we handle personal data on your behalf.

For GDPR-regulated accounts: you can request a full export of all personal data we hold for your account and your contacts at any time by emailing privacy@alwaysrespond.com. Deletion requests are completed within 30 days.

For CCPA-regulated accounts: California residents can request to know, delete, or opt out of the sale of their personal information. AlwaysRespond does not sell personal data. Requests can be submitted to the same address above.

AlwaysRespond maintains a written incident response plan reviewed and updated annually. If a security incident results in unauthorized access to personal data, affected customers will be notified within 72 hours of our confirmation, consistent with GDPR Article 33 timelines.

Notification will include: what data was affected, how the breach occurred (once determined), what we have done to contain it, and steps you should take to protect your account.

We do not run a public status page yet. Incident updates go out by email to account owners, and you can always reach a person at support@alwaysrespond.com.

The following third-party providers process data on behalf of AlwaysRespond:

This list is updated as subprocessors are added or removed. Last updated April 2026.

If you believe you have found a security vulnerability in AlwaysRespond, please report it to security@alwaysrespond.com. Include a description of the issue, reproduction steps, and any relevant screenshots or logs.

We commit to:

• Acknowledging your report within 48 hours
• Providing a status update within 7 business days
• Not pursuing legal action against researchers who follow responsible disclosure practices
• Crediting researchers in our changelog when a fix ships (with your permission)

Please do not publicly disclose the issue until we have confirmed a fix is in place.