Security
How CallFleet protects your calls and data
Your contacts, recordings and results stay inside your workspace. Here is how access, calls and data are protected — described as how the system works, with public tests anyone can rerun.
Checked by public tests
Anyone can rerun these free, independent tests against our live site and API, or read our published security self-assessment.
SSL Labs: A+
HTTPS on the website and the API: TLS 1.2 and 1.3 only, modern ciphers only, HSTS.
Run the test yourselfMozilla Observatory: A+
Browser protections on the website and the API — every one of its 12 tests passed.
Run the test yourselfCSA STAR Registry: Level 1
Our answers to the Cloud Security Alliance's 283-question security questionnaire (CAIQ v4.1) are published in its STAR Registry, listed since 10 November 2026. Anyone can download them.
Run the test yourselfSecurityHeaders.com: A+
All six security headers are sent: HSTS, Content-Security-Policy, X-Frame-Options, X-Content-Type-Options, Referrer-Policy and Permissions-Policy.
Run the test yourself
Access control
Workspace isolation
Every campaign, contact, call and report belongs to one workspace, and the server checks that on every request — including the reporting API.
Roles inside each workspace
Admins manage members and billing, editors build and run campaigns, viewers can only read results.
Hashed passwords and Google sign-in
Passwords are stored as bcrypt hashes, never in plain text; teams can sign in with Google instead.
Sessions that scripts cannot steal
Access tokens last 15 minutes and live only in memory; the login that renews them sits in a secure, HttpOnly cookie that page scripts cannot read.
Protection against password guessing
Logins, password resets and invitations are rate-limited per account and per network address.
Calls and data
Callers are told about recording
Every call says, in the greeting, that it may be recorded for quality purposes.
Personal data kept out of logs
What callers say, their names and their phone numbers are not written to our server logs.
Verified calls only
Call events are accepted only when signed by our telephony provider, and each live call’s audio opens only with a short-lived pass for that one call.
Only what each AI feature needs
AI features receive only the data they need — Build with AI sees a sheet’s column headings and one example row, never your list of people.
Full call provenance
Recording, transcript and evaluation stay attached to the call that produced them, for audit after the fact.
Checked input
Every API request is checked against a strict schema before it reaches the database, and internal errors are never shown to users.
Calling responsibly
Calling hours
Calls go out only between 9 AM and 9 PM India time. A call due outside those hours waits until 9 AM.
Do-not-call list
When someone asks not to be called again, they are added to your workspace’s do-not-call list automatically, and no campaign ever calls them again.
Consent before calling
Before a campaign calls anyone, you confirm the people agreed to be contacted or are existing customers. Who confirmed, and when, is kept as a record.
Sharing and invitations
Expiring share links
Reports shared outside your team use unguessable links that stop working after the period you choose.
Expiring invites
Invitations carry the role they grant and expire if they are not accepted.
Shared pages stay out of search
Shared reports and invitations are excluded from search engines and AI crawlers.
FAQ
Security questions
Who can see my campaigns and calls?
Only members of the workspace they belong to, within the limits of their role — plus anyone you explicitly send an expiring share link to.
Can a shared report link be found by search engines?
No. Shared reports use unguessable links, expire after the period you choose, and are excluded from search engines and AI crawlers.
Do you hold compliance certifications?
We hold no paid certification yet. Our security self-assessment is published in the Cloud Security Alliance STAR Registry (Level 1), and three public tests grade our website and API A+. For specific requirements, contact us before you start.
How do I report a security problem?
Email admin@neosharks.in with the details. We reply within two working days and do not take action against good-faith research. Our contact details are also published at /.well-known/security.txt.
Put outbound calling on autopilot
Launch your first campaign and see every call scored as it lands.