Security and data
Your data is protected by several layers of security.
Each layer below is part of how ContactRoll works today, and each is tested as the product changes. Further down: where your data is kept, how it is backed up, and what happens to it when you leave.
The layers
Each organization’s data kept apart by the database
Every table that holds an organization’s data carries a rule in the database itself that limits each request to the caller’s own organization. Files sit in private storage under each organization’s own space. On every change, hundreds of automated tests try to reach another organization’s data, as every role, and must fail.
Access by role, down to each record
Nine ready-made roles decide what each person can do, and on Plus you can create your own. Each role also decides which records a person sees: everything, their team’s or only their own. The database checks every request against the role.
Encryption in transit and at rest
Every connection to ContactRoll is encrypted, and browsers are told to use nothing else. Stored data is encrypted at rest, and the keys you connect for other services are encrypted again by ContactRoll and never shown to anyone.
Signed and checked webhooks and phone requests
Every webhook ContactRoll sends carries a signature made with a secret only you and ContactRoll hold. Deliveries that arrive are checked against their signatures, and a request from your phone account is confirmed with that account before anything is done.
Strict security headers on every page
Every page sends strict security headers that tell the browser what the page may load and run, which sites may show it in a frame, and to use only encrypted connections.
Automated security scans on every change
Every change is scanned for leaked secrets, every change to the database code is checked for unsafe patterns, and the whole codebase is scanned again every week.
Error and health monitoring, with alerts
ContactRoll records its own errors, in the browser and on its servers, without the message or anything a person typed, and alerts the team to a burst of errors. Health is checked every five minutes.
Call recordings kept in your own phone account
Call audio is never copied into ContactRoll. It is played from your own phone account when a member clicks Play, and kept only in that browser tab while the page is open.
Two-factor sign-in
Anyone can add a code from an authenticator app to their sign-in, with ten one-time backup codes for a lost phone. An Owner can require it for everyone in the organization, and can reset it for a member who has lost their phone.
An audit log
Owners and Administrators can read an audit log of sign-ins, exports, bulk actions and changes, with who did each and when, filter it and download it as a CSV file. It is kept for a year, or for as long as you choose, from 90 days to three years.
Sensitive actions recorded
We record each role change, each play of a call recording, each refund and cancellation, each plan change and each maintenance sign-in, with who did it and when.
See roles and access for who sees what.
Your data
Where it is kept
Your organization’s records and attached files are kept in the United States. Call recordings stay in your own Twilio account. The companies that store and process data for us are named in our privacy policy, and we email every Owner at least 30 days before a new one starts handling their data.
Backups
The database that holds your organization’s records is backed up every day, and the last seven daily backups are kept.
Payments
You pay for Standard or Plus on Stripe’s own checkout page. Your card details go to Stripe and never reach ContactRoll.
Export all your data, any time
On every plan, Free included, an Owner or an Administrator can download everything ContactRoll holds for your organization as one file, whenever they like, with no request to us and no fee. It keeps working while an account is read-only, and after you close it, until the day it is deleted. How to export. Everything about one person, and every attached file, download the same way; Your data is yours says what each download holds.
If you leave
The Owner closes the account on the Team page. Access stops for everyone at once, and for 30 days the Owner can reopen it. After that, everything is deleted within a further 30 days, attached files included. ContactRoll keeps one short note that a deletion happened, with dates and counts, and nothing else.
Our agreement with you
When ContactRoll handles personal data for you, it does so as your processor, on your instructions, under our data processing addendum, which is part of our Terms of Service. For a copy, write to hello@contactroll.com.
This website
This site sets no cookie, runs no third-party script and loads nothing from any other site. Its pages send a strict content security policy and refuse to be framed. A test of every page at phone and desktop width checks all of it on every change. See privacy.
Found a problem?
Write to hello@contactroll.com with "Security" in the subject.
Questions
Where is my data stored?
In the United States, protected by several layers of security. Call recordings stay in your own Twilio account. The layers on this page explain how.
Is my data backed up?
Yes. The database that holds your organization’s records is backed up every day, and the last seven daily backups are kept.
Does ContactRoll see my card details?
No. You pay on Stripe’s own checkout page, and your card details go to Stripe. They never reach ContactRoll.
Can we require two-factor sign-in?
Yes. An Owner can require it for everyone in the organization. Each person signs in with a code from an authenticator app, and has ten one-time backup codes for a lost phone.
What happens to our data if we leave?
An Owner or Administrator can download everything the organization holds as a file, and an Owner can then close the account. Access stops immediately, and you then have 30 days to change your mind. After that, the organization is deleted within another 30 days, files included.