> ## Documentation Index
> Fetch the complete documentation index at: https://docs.callers.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Security and Privacy

> Protect sensitive data in Callers: detect and mask payment data, control who sees transcripts and recordings, set retention, and verify outbound requests.

Callers gives you controls for the data your agents collect: what is stored, for how long, and who can see it. This page covers each control and where to find it. For Callers' own security program and compliance documents, visit the [Callers Trust Center](https://trust.callers.ai). For calling and messaging rules that apply to your agents, see [Compliance](https://docs.callers.ai/documentation/best-practices/compliance.md).

## Controls at a glance

| Control | Where | What it protects |
| - | - | - |
| [Sensitive data detection](#sensitive-data-detection) | Agent settings | Card numbers, CVVs, and PINs said during calls |
| [Member access](#control-who-sees-conversation-data) | Settings → Team | Contact phone numbers, transcripts, and recordings |
| [Retention period](#data-retention) | Settings → General | How long recordings and transcripts are kept |
| [Restrict Support Access](#restrict-support-access) | Settings → General | Whether Callers support staff can open your account |
| [MFA](https://docs.callers.ai/documentation/account/team-and-permissions.md#multi-factor-authentication-mfa) and [SSO](https://docs.callers.ai/documentation/using-callers/sso-login.md) | Settings → General / support | How members log in |
| [Request signing](#verify-requests-from-callers) | Settings → General | Proves webhooks and actions come from Callers |
| [IP allowlist](#allowlist-callers-ip-addresses) | Your firewall | Which IPs can reach your endpoints |

## Sensitive data detection

Sensitive data detection finds credit card numbers, CVVs, and PINs in call transcripts. Use it when callers may read out payment details, for example in collections or payment agents.

When detection is on, Callers restricts the transcript and recording of any conversation that contains sensitive data. Members see **Content Restricted** instead of the conversation. Admins can click **Reveal Content** to view it.

### Turn it on

**1. Open the agent settings**

Open the agent and go to **General Info** in the settings sidebar.

**2. Enable detection**

Turn on **Sensitive data detection**.

**3. Choose how to handle detected data**

Turn on any of the options below, then save and publish the agent.

| Option | What it does |
| - | - |
| **Mask sensitive messages** | Permanently replaces each transcript message that contains sensitive data with a mask. The rest of the transcript stays readable. |
| **Delete transcripts with sensitive data** | Permanently deletes the whole transcript of any call with sensitive data. Members see **Content Redacted**. When this is on, **Mask sensitive messages** is unavailable, because there's no transcript left to mask. |
| **Delete recordings with sensitive data** | Permanently deletes the whole call recording of any call with sensitive data. |

> [!WARNING]
>
> Masking and deletion are permanent and can't be undone. For strict PCI requirements, turn on both delete options so no transcript or recording with payment data is kept.

### Account-wide restriction

Callers can also turn on a **Sensitive content restriction** for a whole account, so every agent hides conversations with sensitive data. With this restriction, conversations that haven't been analyzed yet are also hidden until analysis is done. Agencies can set this per subaccount in the subaccount's **Permissions**. See [Managing subaccounts](https://docs.callers.ai/documentation/agencies/managing-subaccounts.md#permissions). To turn it on for your main account, contact [support@callers.ai](mailto:support@callers.ai).

## Control who sees conversation data

Limit what each member can see, on top of their role, in **Settings → Team**:

| Access toggle | When turned off |
| - | - |
| **Access contact phone numbers** | Contact phone numbers are masked for the member. |
| **View transcripts and recordings** | Transcripts and recordings are hidden. The member sees **Content Hidden**. |
| **Export contacts or calls** | The member can't export data to CSV. |
| **View Analytics** | The member can't open Analytics. |

See [Team and permissions](https://docs.callers.ai/documentation/account/team-and-permissions.md#member-access) for all toggles.

## Data retention

Set how long Callers keeps call recordings and transcriptions. Callers deletes data older than the retention period.

1. Click your name, choose **Settings**, and open **General**.
2. Under **Retention period**, choose **90 days**, **180 days**, **1 year**, **2 years**, **3 years**, **4 years**, **5 years**, or **Custom**.
3. For **Custom**, enter the number of days (at least 5).

The default is 1 year (365 days). Only members who can **Manage account settings** can change it.

You can also set retention with the API, optionally for all subaccounts at once:

```bash cURL theme={"dark"}
curl -X POST https://api.callers.ai/organization/set-recording-retention \
  -H "Authorization: $CALLERS_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{ "retentionDays": 180, "subAccounts": true }'
```

```javascript Node.js theme={"dark"}
await fetch("https://api.callers.ai/organization/set-recording-retention", {
  method: "POST",
  headers: {
    Authorization: process.env.CALLERS_API_KEY,
    "Content-Type": "application/json",
  },
  body: JSON.stringify({ retentionDays: 180, subAccounts: true }),
});
```

```python Python theme={"dark"}
import os
import requests

requests.post(
    "https://api.callers.ai/organization/set-recording-retention",
    headers={"Authorization": os.environ["CALLERS_API_KEY"]},
    json={"retentionDays": 180, "subAccounts": True},
)
```

> [!TIP]
>
> To avoid storing recordings at all for an agent, turn off **Record Calls** in its settings. See [Call recording and limits](https://docs.callers.ai/documentation/voice/call-recording-and-limits.md).

## Audit trail

Callers keeps a record of what changed and what happened, so you can trace a result back to a configuration or a conversation. There is no single audit-log page; each record lives next to the thing it describes.

| What you want to know | Where to look |
| - | - |
| Who changed an agent, and when | **Versions History** on the agent lists every saved snapshot with its date and the member who saved it, and lets you restore any of them. See [Versions](https://docs.callers.ai/documentation/build-your-agent/versions-and-split-traffic.md#version-history). |
| Which version performed better | With [Split Traffic](https://docs.callers.ai/documentation/build-your-agent/versions-and-split-traffic.md#split-traffic), results and [insights](https://docs.callers.ai/documentation/using-callers/agent-insights.md) are reported per published version, so you can attribute outcomes to the script that produced them. |
| What was said | The transcript and recording of every call, chat, and email thread, kept for your [retention period](#data-retention). Access is limited to members with **View transcripts and recordings**. |
| What your systems were sent | The **Logs** on each webhook show every delivery attempt with the request, the response, and the retry outcome. See [Webhook logs](https://docs.callers.ai/documentation/webhook/webhook-overview.md#logs). |
| What the agent called mid-conversation | Each action in a transcript expands to its request and response, including pre-conversation actions and [custom code](https://docs.callers.ai/documentation/build-your-agent/agent-actions.md). |
| Who can see or export data | Roles and per-member access toggles in [Team and permissions](https://docs.callers.ai/documentation/account/team-and-permissions.md#member-access); API keys are listed with their creation date under **Settings → API Keys**. |
| Which outcome a contact got, and why | The contact's **Interactions** timeline and **Summary** tab show every attempt, its status, and the success criterion that decided it. See [Statuses and outcomes](https://docs.callers.ai/documentation/using-callers/call-statuses.md). |

> [!TIP]
>
> For compliance reviews, export contacts or calls from an agent's results page (members with **Export contacts or calls**) and keep the webhook payloads your systems received; together they form a complete, timestamped record of every conversation.

## Restrict Support Access

By default, Callers support staff and account managers can open your account to help with setup and troubleshooting. To block that:

1. Go to **Settings → General**.
2. Turn on **Restrict Support Access**.

You can still give a specific support person access by inviting them as a member in **Settings → Team**.

## Verify requests from Callers

Callers signs the HTTP requests it sends to your webhook endpoints, so you can confirm they're genuine and unchanged.

* **Webhook Signature.** In **Settings → General**, click **Show HMAC Secret** to see your account's secret. Callers signs requests with HMAC-SHA256 and sends the signature in the `X-Signature` header.
* **Signature type.** Advanced webhooks and HTTP actions also send `X-Signature-Type` (`HMAC` or `RSA`). In an HTTP action, turn on **Sign with RSA-SHA256** to sign with RSA instead of your HMAC secret.

For verification code, see [Validating webhook signatures](https://docs.callers.ai/documentation/webhook/validating-webhook-signatures.md).

## Allowlist Callers IP addresses

If your webhook endpoints or the APIs your actions call are behind a firewall, allow requests from these Callers IP addresses:

```
35.245.204.86
35.221.61.75
```

## Related

> **[Callers Trust Center](https://trust.callers.ai)**
>
> Security practices and compliance documents.

> **[Team and permissions](https://docs.callers.ai/documentation/account/team-and-permissions.md)**
>
> Roles, member access, and MFA.

> **[Do Not Call](https://docs.callers.ai/documentation/contacts/do-not-call.md)**
>
> Honor opt-outs and DNC registries.

> **[Validating webhook signatures](https://docs.callers.ai/documentation/webhook/validating-webhook-signatures.md)**
>
> Verify that requests come from Callers.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.