Home › Security
Security
What we do to protect call data, what we haven't done yet, and how to tell us if you find a hole.
Protecting call data
Call audio, transcripts and caller details are encrypted in transit and at rest. Each client's data is logically segregated, and recordings and logs are written to storage we control rather than left with a third party. Recording can be disabled entirely on any plan if you would rather we did not hold it.
Access control
Access to production systems is limited to the people who need it, requires multi-factor authentication, and is logged. Team members with production access are background checked, hold the minimum permissions for their role, and lose access the day they leave. Clients control who in their own organisation can see recordings and transcripts.
Brimeo is operated from Canada, call data is stored in the United States, and our engineering and operations team accesses systems from Pakistan under those controls. We say so here rather than leaving you to discover it — see the Privacy Policy.
Live calls are processed in real time, which means call content may be accessible to our systems and technology providers while a call is in progress.
Retention and deletion
We publish a specific retention schedule rather than saying "as long as necessary": recordings, transcripts and caller details are deleted after 90 days. You can set a shorter period, and you can delete any individual call from the dashboard immediately. The full table is in the Privacy Policy.
Vendors
We name every vendor that touches call content — Vapi, Twilio, Telnyx, Deepgram, ElevenLabs, OpenAI, Supabase, Vercel, Google and Airwallex — in the Privacy Policy, along with what each one does. We give 30 days' notice before adding one. Most vendors in this market do not publish a list at all.
AI commitments
- Your call data is not used to train our models or anyone else's. Training on customer data is switched off in our provider configurations.
- We do not create, store or use voiceprints. Speaker diarization is switched off, so no speaker representation is produced.
- Agents identify themselves as AI when asked, and can be configured to disclose upfront.
- We will not configure an agent to impersonate a named person.
What we don't have yet
We would rather say this than let you find out in procurement:
- No SOC 2 report. We are a small company and have not completed an audit. If that is a hard requirement for you, we are not the right fit today.
- No HIPAA BAA. The service is not offered for Protected Health Information. See the Terms.
- No penetration test yet.
We will update this page as that changes, with dates.
Reporting a vulnerability
If you think you have found a security issue, email security@brimeo.io with enough detail to reproduce it. We will acknowledge within two business days.
We ask that you do not exploit the issue beyond demonstrating it, do not access or change anyone else's data, and give us reasonable time to fix it before publishing. We will not pursue legal action against good-faith research that follows those lines.