> ## Documentation Index
> Fetch the complete documentation index at: https://docs.callers.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Security overview

> Every security and privacy control in Callers in one place: guardrails, sensitive data, access, retention, dial-only phone numbers, sign-in, and request verification.

Callers gives you controls for the data your agents collect and for what your agents may say: what is stored, for how long, who can see it, and which responses are blocked. This page lists each control and where to find it. For Callers' own security program and compliance documents, visit the [Callers Trust Center](https://trust.callers.ai). For calling and messaging rules that apply to your agents, see [Compliance](https://docs.callers.ai/documentation/best-practices/compliance.md).

## Controls at a glance

| Control | Where | What it protects |
| - | - | - |
| [Guardrails](https://docs.callers.ai/documentation/build-your-agent/instructions-and-guardrails.md#guardrails) | Sidebar → Guardrails, and each agent | What the agent may say; blocked responses end or transfer the call |
| [Sensitive data detection](https://docs.callers.ai/documentation/security/sensitive-data.md) | Agent → General Settings → Technical Settings | Payment data and credentials; on voice call agents also personal identifiers, health information, and custom categories |
| [Member access](https://docs.callers.ai/documentation/security/data-access-and-retention.md#control-who-sees-conversation-data) | Settings → Team | Contact phone numbers, transcripts, and recordings |
| [Retention period](https://docs.callers.ai/documentation/security/data-access-and-retention.md#data-retention) | Settings → General | How long recordings and transcripts are kept |
| [Record Calls](https://docs.callers.ai/documentation/voice/call-recording-and-limits.md#call-recording) | Agent → Technical Settings | Whether calls are recorded at all |
| [Dial-only phone numbers](https://docs.callers.ai/documentation/security/dial-only-phone-numbers.md) | Agent → Workflow | Contact phone numbers, fetched from your system before each call instead of being uploaded |
| [Restrict Support Access](https://docs.callers.ai/documentation/security/data-access-and-retention.md#restrict-support-access) | Settings → General | Whether Callers support staff can open your account |
| [Audit trail](https://docs.callers.ai/documentation/security/data-access-and-retention.md#audit-trail) | Versions, transcripts, webhook logs | Who changed what, and what happened in each conversation |
| [MFA](https://docs.callers.ai/documentation/account/team-and-permissions.md#multi-factor-authentication-mfa) and [SSO](https://docs.callers.ai/documentation/using-callers/sso-login.md) | Settings → General / support | How members log in |
| [Do Not Call](https://docs.callers.ai/documentation/contacts/do-not-call.md) | Agent → Technical Settings, Contacts | Numbers that must never be dialed |
| [Request signing](#verify-requests-from-callers) | Settings → General | Proves webhooks and actions come from Callers |
| [IP allowlist](#allowlist-callers-ip-addresses) | Your firewall | Which IPs can reach your endpoints |

## Pick the controls for your use case

> [card] [Agents that take payments](https://docs.callers.ai/documentation/security/sensitive-data.md)
>
> Detect **Payment and credentials**, and delete transcripts and recordings that contain them.

> [card] [Healthcare and other regulated data](https://docs.callers.ai/documentation/security/dial-only-phone-numbers.md)
>
> Keep phone numbers in your own system, and detect **Personal identifiers** and **Health information**.

> [card] [Limit what the agent says](https://docs.callers.ai/documentation/build-your-agent/instructions-and-guardrails.md#guardrails)
>
> Block advice, commitments, or off-topic answers with guardrails.

> [card] [Limit who sees conversations](https://docs.callers.ai/documentation/security/data-access-and-retention.md)
>
> Member access, retention, and support access.

## Verify requests from Callers

Callers signs the HTTP requests it sends to your webhook endpoints, so you can confirm they're genuine and unchanged.

* **Webhook Signature.** In **Settings → General**, click **Show HMAC Secret** to see your account's secret. Callers signs requests with HMAC-SHA256 and sends the signature in the `X-Signature` header.
* **Signature type.** Advanced webhooks and HTTP actions also send `X-Signature-Type` (`HMAC` or `RSA`). In an HTTP action, turn on **Sign with RSA-SHA256** to sign with RSA instead of your HMAC secret.

For verification code, see [Validating webhook signatures](https://docs.callers.ai/documentation/webhook/validating-webhook-signatures.md).

## Allowlist Callers IP addresses

If your webhook endpoints or the APIs your actions call are behind a firewall, allow requests from these Callers IP addresses:

```
35.245.204.86
35.221.61.75
```

## Related

> [card] [Callers Trust Center](https://trust.callers.ai)
>
> Security practices and compliance documents.

> [card] [Team and permissions](https://docs.callers.ai/documentation/account/team-and-permissions.md)
>
> Roles, member access, and MFA.

> [card] [Do Not Call](https://docs.callers.ai/documentation/contacts/do-not-call.md)
>
> Honor opt-outs and DNC registries.

> [card] [Validating webhook signatures](https://docs.callers.ai/documentation/webhook/validating-webhook-signatures.md)
>
> Verify that requests come from Callers.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.