Security Overview
Effective Date: October 10, 2026
1. Our Approach to Security
Calladhere is operated by RingFuze Technologies LLC (“RingFuze,” “we,” or “us”). Our customers trust us with sensitive information, including call recordings and protected health information (“PHI”) about Medicare and ACA consumers. This Security Overview describes the main safeguards we use to protect that information.
Security is a shared responsibility. We secure the Service and the infrastructure it runs on, and customers are responsible for how they configure and use the Service, as described in Section 13. This overview is provided for information. It is not a certification or a contractual warranty, and our commitments to customers are set out in our Terms of Service, Data Processing Addendum, and, where applicable, our Business Associate Agreement. We update our practices over time as the Service and the threat landscape evolve.
2. Infrastructure and Hosting
Calladhere is built on established, U.S.-based cloud service providers. Our primary database, file storage (including call recordings), and backend compute run with our cloud infrastructure provider, and our web application is served by our application hosting provider. Customer Data is stored and processed in the United States, and web traffic may be delivered through a global edge network.
By relying on these providers, we benefit from their physical data center security, network protections, and infrastructure operations.
3. Encryption
In transit. Connections to the Calladhere application, API, and backend use TLS encryption.
At rest. Customer Data, including stored call recordings, is encrypted at rest by our infrastructure providers.
4. Access Control and Tenant Isolation
Tenant isolation. Calladhere is a multi-tenant service. Customer Data is scoped to the organization that owns it, and the Service checks a user’s organization membership before returning or changing data, so that users of one organization cannot access another organization’s data.
Role-based access. Within an organization, access is governed by roles (such as admin, manager, QA reviewer, and agent, with a separate role for partner resellers) and by granular permission presets that administrators can configure. For example, managers can be scoped to the agents assigned to them.
RingFuze personnel. Access by our personnel to Customer Data is limited to authorized individuals with a business need, such as providing support you request, investigating and resolving issues, maintaining security, and quality assurance and accuracy evaluation of the Service, under access controls.
5. Authentication
User authentication, sessions, and organization membership are managed through a dedicated third-party authentication provider. Multi-factor authentication is available to all users, and we strongly recommend that every customer require it for their users. Organization administrators can see which members have multi-factor authentication enabled.
We verify webhook signatures for events received from our authentication and payment providers, so that forged events are rejected.
6. API Security
Calladhere offers a public API and MCP server for programmatic access. API keys are protected as follows:
Hashed keys. API keys are randomly generated secrets that are shown only once at creation and stored as one-way hashes. We cannot retrieve a key after it is created.
Scopes. Each key is limited to the permissions (scopes) selected when it is created.
Rotation and expiration. Keys can be rotated, with a grace window that lets you move integrations to a new key without downtime, and can be set to expire.
Rate limits. API requests are rate limited according to your plan tier.
Access logs. API requests are logged so that usage can be reviewed.
PHI scope gating. Access to PHI through the API, such as call transcripts, requires a dedicated PHI scope. That scope is available only after your organization has accepted our API Terms and has a Business Associate Agreement countersigned by Calladhere. See our HIPAA & Business Associate Agreement page.
7. Activity and Audit Logging
Calladhere records an activity log of significant user actions within the Service, including information such as the user, the action taken, the time, the IP address, and the browser user agent. Activity log entries are retained for 365 days and help customers and our team investigate account activity.
E-signatures captured in the Service, including Business Associate Agreement execution, are recorded with the signer’s name, title, IP address, user agent, and timestamp.
8. AI Provider Safeguards
Calladhere uses contracted third-party providers for speech-to-text transcription and AI analysis. We use these providers under their commercial API offerings, and we require appropriate agreements with them, including Business Associate Agreements where PHI is processed.
We send providers only the data needed for the task, such as call audio for transcription or transcripts and relevant record fields for audit analysis. We do not use Customer Data to train our own or third-party foundation models. For more detail, see our AI Transparency Statement.
9. Data Retention and Deletion
Recording retention. Organization administrators can set a retention period for recordings and files, from 1 to 3,650 days. Files past their retention period are deleted automatically on a daily basis. If no retention period is set, files are retained for the life of the account.
Logs and exports. Activity logs are retained for 365 days, operational logs for 30 to 90 days, and generated report exports for 7 days.
Account termination. Customers can export their data before termination. After termination, upon written request, we delete or return Customer Data within 60 days, except for data held in backups (which roll off in the ordinary course) and records we must retain by law.
10. Vendor Management
Before engaging a vendor that will process Customer Data, we evaluate its services and data protection practices in light of the data it will handle. We enter into written agreements that impose appropriate data protection obligations, including Business Associate Agreements with vendors that process PHI on our behalf, and we share only the data each vendor needs. We provide customers at least 30 days’ notice before adding a new subprocessor, except in emergencies, as described in our Data Processing Addendum.
11. Incident Response
We maintain procedures for identifying, investigating, containing, and remediating security incidents. If we become aware of a security incident affecting Customer Data, we will notify affected customers without undue delay and in accordance with our Data Processing Addendum, our Business Associate Agreement where applicable, and applicable law. We will provide information reasonably available to us to help customers meet their own obligations, and we review incidents to improve our safeguards.
If you suspect a security incident involving your Calladhere account, contact security@calladhere.com immediately.
12. Responsible Disclosure
We welcome reports from security researchers who find vulnerabilities in Calladhere. Please email security@calladhere.com with a description of the issue, the steps to reproduce it, the affected URL or component, and its potential impact.
Guidelines. When researching vulnerabilities, please:
Do not access, modify, or delete data belonging to other users or organizations. Use only accounts you own or have permission to test, and stop and notify us if you encounter others’ data.
Do not perform denial-of-service attacks, automated testing that degrades the Service, social engineering or phishing of our personnel or customers, or physical attacks.
Do not publicly disclose a vulnerability until we have had a reasonable opportunity to investigate and fix it.
Safe harbor. If you make a good-faith effort to follow these guidelines, we will not pursue legal action against you for your research, and we will work with you to understand and address the issue. This policy does not authorize testing of third-party services we use, and it does not create a right to compensation.
13. Customer Security Responsibilities
Customers play an essential role in protecting their data. You are responsible for:
Managing users. Granting access only to people who need it, assigning appropriate roles and permissions, and promptly removing users who leave your organization.
Protecting credentials. Requiring multi-factor authentication, keeping passwords confidential, and storing API keys securely, rotating them if they may have been exposed.
Configuring the Service. Setting retention periods that match your obligations, enabling only the integrations you trust, and limiting API key scopes to what each integration needs.
Handling exported data. Protecting data you export or download from the Service, and sending PHI only to people and tools authorized to receive it.
Legal obligations. Executing a Business Associate Agreement before submitting PHI where required, and complying with our Acceptable Use Policy.
Reporting. Notifying us promptly at security@calladhere.com if you suspect unauthorized access to your account.
14. Contact Us
To report a vulnerability or security incident, contact security@calladhere.com. For HIPAA and compliance questions, contact compliance@calladhere.com. For general support, contact support@calladhere.com.
RingFuze Technologies LLC (dba Calladhere)
3770 Shaw Ave, Suite 102-226
Clovis, CA 93619
USA