The short version. Encrypted in transit and at rest, one account per client, no AI training on your data, named vendors, incident notice within 72 hours, and a real email for reporting a vulnerability.
Data protection
All traffic is encrypted with TLS 1.2 or higher. Stored data, including recordings and transcripts, is encrypted at rest with AES-256.
Each client's data is held in its own account in our CRM platform and separated by row-level security in our database. No client can see another's data.
Payment card details are entered directly with Stripe. We never see or store full card numbers.
Call recordings and transcripts are retained for the periods in our Privacy Policy and deleted on schedule or on request.
Access
Access to client data is limited to the people who need it to deliver the service, protected by multi-factor authentication, and logged.
Clients control who on their team can sign in and can remove access at any time.
Staff and contractors sign confidentiality agreements before any access.
AI and vendors
Your data is not used to train AI models, by us or by our vendors, who are bound by contract.
Our vendors are listed in the Privacy Policy. Each is reviewed for security before use and holds its own independent security audits (for example SOC 2 reports), which we review.
The assistant is instructed to ignore attempts to change its instructions, never reveals its configuration, cannot execute code, and hands off to a person when its confidence is low.
Compliance
Texting and calling follow the controls in our Messaging Terms: consent records, immediate opt-outs, quiet hours, do-not-call checks, five-year record retention.
Calls are recorded only after the assistant discloses recording, in every state.
We do not handle protected health information under HIPAA at this time.
A SOC 2 Type 1 attestation of our own controls is planned; ask us for the current status.
Incidents
If a security incident affects client data we notify affected clients without undue delay and within 72 hours of confirming it, with what happened, what data was involved, what we have done, and what you should do. We notify individuals as the law requires.
Reporting a vulnerability
If you believe you have found a security issue in powerframe.ai or our services, email hello@powerframe.ai with "security" in the subject. We acknowledge within two business days, keep you informed, and will not take legal action against good-faith research that avoids privacy violations, data destruction and service disruption. Please do not access data that is not yours and do not disclose the issue publicly until we have fixed it.
Business continuity
Our services run on redundant cloud infrastructure with daily encrypted backups retained for 35 days. If the AI assistant is unavailable, calls forward to the client's designated fallback number so that no call goes unanswered.