Security and Privacy

Callers gives you controls for the data your agents collect: what is stored, for how long, and who can see it. This page covers each control and where to find it. For Callers’ own security program and compliance documents, visit the Callers Trust Center. For calling and messaging rules that apply to your agents, see Compliance.

Controls at a glance

Control	Where	What it protects
Sensitive data detection	Agent settings	Card numbers, CVVs, and PINs said during calls
Member access	Settings → Team	Contact phone numbers, transcripts, and recordings
Retention period	Settings → General	How long recordings and transcripts are kept
Restrict Support Access	Settings → General	Whether Callers support staff can open your account
MFA and SSO	Settings → General / support	How members log in
Request signing	Settings → General	Proves webhooks and actions come from Callers
IP allowlist	Your firewall	Which IPs can reach your endpoints

Sensitive data detection

Sensitive data detection finds credit card numbers, CVVs, and PINs in call transcripts. Use it when callers may read out payment details, for example in collections or payment agents. When detection is on, Callers restricts the transcript and recording of any conversation that contains sensitive data. Members see Content Restricted instead of the conversation. Admins can click Reveal Content to view it.

Turn it on

Open the agent settings

Open the agent and go to General Info in the settings sidebar.

Enable detection

Turn on Sensitive data detection.

Choose how to handle detected data

Turn on any of the options below, then save and publish the agent.

Option	What it does
Mask sensitive messages	Permanently replaces each transcript message that contains sensitive data with a mask. The rest of the transcript stays readable.
Delete transcripts with sensitive data	Permanently deletes the whole transcript of any call with sensitive data. Members see Content Redacted. When this is on, Mask sensitive messages is unavailable, because there’s no transcript left to mask.
Delete recordings with sensitive data	Permanently deletes the whole call recording of any call with sensitive data.

Masking and deletion are permanent and can’t be undone. For strict PCI requirements, turn on both delete options so no transcript or recording with payment data is kept.

Account-wide restriction

Callers can also turn on a Sensitive content restriction for a whole account, so every agent hides conversations with sensitive data. With this restriction, conversations that haven’t been analyzed yet are also hidden until analysis is done. Agencies can set this per subaccount in the subaccount’s Permissions. See Managing subaccounts. To turn it on for your main account, contact support@callers.ai.

Control who sees conversation data

Limit what each member can see, on top of their role, in Settings → Team:

Access toggle	When turned off
Access contact phone numbers	Contact phone numbers are masked for the member.
View transcripts and recordings	Transcripts and recordings are hidden. The member sees Content Hidden.
Export contacts or calls	The member can’t export data to CSV.
View Analytics	The member can’t open Analytics.

See Team and permissions for all toggles.

Data retention

Set how long Callers keeps call recordings and transcriptions. Callers deletes data older than the retention period.

Click your name, choose Settings, and open General.
Under Retention period, choose 90 days, 180 days, 1 year, 2 years, 3 years, 4 years, 5 years, or Custom.
For Custom, enter the number of days (at least 5).

The default is 1 year (365 days). Only members who can Manage account settings can change it. You can also set retention with the API, optionally for all subaccounts at once:

curl -X POST https://api.callers.ai/organization/set-recording-retention \
  -H "Authorization: $CALLERS_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{ "retentionDays": 180, "subAccounts": true }'

await fetch("https://api.callers.ai/organization/set-recording-retention", {
  method: "POST",
  headers: {
    Authorization: process.env.CALLERS_API_KEY,
    "Content-Type": "application/json",
  },
  body: JSON.stringify({ retentionDays: 180, subAccounts: true }),
});

import os
import requests

requests.post(
    "https://api.callers.ai/organization/set-recording-retention",
    headers={"Authorization": os.environ["CALLERS_API_KEY"]},
    json={"retentionDays": 180, "subAccounts": True},
)

To avoid storing recordings at all for an agent, turn off Record Calls in its settings. See Call recording and limits.

Audit trail

Callers keeps a record of what changed and what happened, so you can trace a result back to a configuration or a conversation. There is no single audit-log page; each record lives next to the thing it describes.

What you want to know	Where to look
Who changed an agent, and when	Versions History on the agent lists every saved snapshot with its date and the member who saved it, and lets you restore any of them. See Versions.
Which version performed better	With Split Traffic, results and insights are reported per published version, so you can attribute outcomes to the script that produced them.
What was said	The transcript and recording of every call, chat, and email thread, kept for your retention period. Access is limited to members with View transcripts and recordings.
What your systems were sent	The Logs on each webhook show every delivery attempt with the request, the response, and the retry outcome. See Webhook logs.
What the agent called mid-conversation	Each action in a transcript expands to its request and response, including pre-conversation actions and custom code.
Who can see or export data	Roles and per-member access toggles in Team and permissions; API keys are listed with their creation date under Settings → API Keys.
Which outcome a contact got, and why	The contact’s Interactions timeline and Summary tab show every attempt, its status, and the success criterion that decided it. See Statuses and outcomes.

For compliance reviews, export contacts or calls from an agent’s results page (members with Export contacts or calls) and keep the webhook payloads your systems received; together they form a complete, timestamped record of every conversation.

Restrict Support Access

By default, Callers support staff and account managers can open your account to help with setup and troubleshooting. To block that:

Go to Settings → General.
Turn on Restrict Support Access.

You can still give a specific support person access by inviting them as a member in Settings → Team.

Verify requests from Callers

Callers signs the HTTP requests it sends to your webhook endpoints, so you can confirm they’re genuine and unchanged.

Webhook Signature. In Settings → General, click Show HMAC Secret to see your account’s secret. Callers signs requests with HMAC-SHA256 and sends the signature in the X-Signature header.
Signature type. Advanced webhooks and HTTP actions also send X-Signature-Type (HMAC or RSA). In an HTTP action, turn on Sign with RSA-SHA256 to sign with RSA instead of your HMAC secret.

For verification code, see Validating webhook signatures.

Allowlist Callers IP addresses

If your webhook endpoints or the APIs your actions call are behind a firewall, allow requests from these Callers IP addresses:

35.245.204.86
35.221.61.75

Callers Trust Center

Security practices and compliance documents.

Team and permissions

Roles, member access, and MFA.

Do Not Call

Honor opt-outs and DNC registries.

Validating webhook signatures

Verify that requests come from Callers.

Get started

Build your agent

Test and deploy

Voice

Channels

Contacts and outreach

Results and analytics

Human operators

Best practices

Account and administration

Enterprise

Resources

Security and Privacy

Controls at a glance

Sensitive data detection

Turn it on

Account-wide restriction

Control who sees conversation data

Data retention

Audit trail

Restrict Support Access

Verify requests from Callers

Allowlist Callers IP addresses

Callers Trust Center

Team and permissions

Do Not Call

Validating webhook signatures

​Controls at a glance

​Sensitive data detection

​Turn it on

​Account-wide restriction

​Control who sees conversation data

​Data retention

​Audit trail

​Restrict Support Access

​Verify requests from Callers

​Allowlist Callers IP addresses

​Related

Callers Trust Center

Team and permissions

Do Not Call

Validating webhook signatures

Controls at a glance

Sensitive data detection

Turn it on

Account-wide restriction

Control who sees conversation data

Data retention

Audit trail

Restrict Support Access

Verify requests from Callers

Allowlist Callers IP addresses

Related