Security

AgentReception AI follows practical security principles designed for a small-business SaaS platform. Our approach is to understand what data the service handles, limit unnecessary access, protect data in transit and at rest where appropriate, monitor reliability and abuse signals, plan for incidents, and keep provider integrations controlled.

• Know what business, customer, and operational data the platform processes.
• Limit access to the minimum needed to operate and support the service.
• Use reasonable safeguards for stored and transmitted data.
• Monitor for reliability issues, failed jobs, and abuse signals where available.
• Prepare to investigate and respond to suspected security issues.
• Keep third-party integrations scoped to the features they support.

Depending on how a business uses AgentReception AI, the platform may handle:

• Business account and profile data
• Customer and lead information
• Conversations, inbox messages, and follow-up records
• Call summaries, transcripts, and call metadata if voice features are enabled
• Appointment and calendar data
• SMS and WhatsApp records
• Billing and subscription records
• Usage, log, and diagnostic data
• Consent and opt-out records

For more detail on collection and use, see our Privacy Policy.

• Each business workspace should only access its own leads, conversations, appointments, channels, usage, billing, and settings.
• Internal admin views are separate from normal customer dashboard views.
• Technical provider and debug information should not appear in standard customer dashboards.
• Future Supabase Row Level Security and related tenant controls are intended to enforce workspace isolation at the data layer.

• Business owners should invite only trusted staff into a workspace.
• Users should use strong passwords and protect login credentials.
• Access should be removed when staff leave or no longer need workspace access.
• Role-based access may be used to limit what staff can view or change.
• AgentReception AI will continue improving account security as the platform matures.

Multi-factor authentication and single sign-on may be offered in the future, but are not represented here as currently available unless explicitly enabled in the product.

AgentReception AI may rely on providers such as:

• Supabase for authentication and database services
• Twilio for SMS, voice, and WhatsApp
• Stripe for payments and subscription billing
• Resend for transactional email notifications
• Google Calendar for calendar sync when connected
• AI providers for AI-assisted features

Connected services may require OAuth, API keys, tokens, or other credentials. Access should be limited to what is needed for the connected feature, and businesses can disconnect supported integrations where account or provider controls allow.

Provider integrations may remain disabled until a business completes setup, credentials are configured, and any required provider or carrier approval is in place. AgentReception AI does not send live SMS, voice, WhatsApp, email, calendar sync, or customer-facing AI messages through those providers when related features or account controls keep them off.

• SMS, calls, and WhatsApp features should be used for customer-care and appointment workflows when enabled for a workspace.
• SMS, voice, and WhatsApp sending may be disabled until channel setup, provider approval, and account enablement are complete.
• Consent and opt-out records may be stored for compliance, audit, and provider requirements.
• Voice features may create call summaries, transcripts, or metadata when enabled.
• Businesses are responsible for call recording or transcription notices where required by law.
• Providers and carriers may filter, delay, reject, suspend, or block messages or calls for security or compliance reasons.

If Google Calendar is connected, AgentReception AI may access calendar data needed for appointment workflow, such as creating, updating, syncing, and displaying appointment events. Calendar sync is not active for every account until the business connects Google Calendar and the integration is enabled.

• Calendar data should be used for scheduling and appointment-related operations.
• Google Calendar is a connected service, not the only source of truth for a business schedule.
• Disconnecting Google Calendar may affect sync, reminders, or appointment workflows.

The scope of Google Calendar data access depends on the permissions granted at connection time and the appointment features enabled in the workspace. Final provider and product settings should be confirmed before broad production rollout.

When live billing is enabled for an account, payments are processed by Stripe. AgentReception AI should not store full payment card numbers directly. We may store billing status, invoices, plan details, subscription state, and limited payment metadata needed for account management.

Checkout, subscription changes, and billing portal access may be disabled during test mode, controlled rollout, or maintenance. When disabled, no live payment data is collected through checkout flows in the Service.

• AI may use business-provided data and conversation context to generate replies, summaries, classifications, and next-step suggestions.
• Businesses should avoid adding unnecessary sensitive data to AI training content or workspace settings.
• AI output should be reviewed before sending sensitive, regulated, or high-value messages.
• Whether AI provider data is used for model training or other secondary purposes depends on the applicable provider settings and contractual terms in place at the time.
• AI-assisted replies or customer-facing sends may be limited or disabled until AI providers are connected and the related feature is enabled for the workspace.

Internal admin views may show system health, failed jobs, failed messages, failed calls, failed syncs, and billing issues. This operational monitoring is separate from normal customer dashboard data.

• We do not guarantee uninterrupted uptime.
• We do not guarantee that every message, call, sync, or workflow will succeed.
• Provider outages, API changes, or network issues may affect service reliability.

If a security issue is suspected, AgentReception AI may investigate, limit access, rotate credentials, disable affected features, notify affected users where appropriate, and work with providers as needed.

Exact investigation steps, timelines, and legal notices may depend on the situation, severity, and applicable law. Our formal incident response runbook, escalation paths, and breach notification procedures are being finalized and may be updated as the platform matures.

Businesses using AgentReception AI are responsible for:

• Keeping business settings accurate and up to date
• Sending lawful customer communications
• Controlling staff access to workspaces
• Protecting login credentials and workspace access
• Not sharing secrets, API keys, or passwords insecurely
• Reviewing AI output when messages are sensitive or high-impact
• Honoring privacy and messaging requests where applicable
• Using connected accounts and integrations responsibly

• No system is 100% secure.
• AgentReception AI does not currently claim SOC 2 certification.
• AgentReception AI does not currently claim HIPAA compliance.
• AgentReception AI does not currently claim ISO 27001 or similar certification.
• Security features and controls will continue improving as the product matures.

If you believe you have found a security issue affecting AgentReception AI, contact security@agentreceptionai.com.

Please include, when possible:

• A clear description of the issue
• The affected page, feature, or workflow
• Steps to reproduce, if applicable
• Screenshots or logs only if they are safe to share
• Your contact information

Do not include passwords, full API keys, or other secrets in your report. We do not currently offer a public bug bounty program unless separately announced.

Our Privacy Policy explains how information is collected, used, and protected. Our Terms of Service govern use of the platform. Our Messaging Policy explains communication rules for SMS, calls, WhatsApp, and related features.

• General support: support@agentreceptionai.com
• Security reports: security@agentreceptionai.com
• Legal notices: legal@agentreceptionai.com
• Privacy requests: privacy@agentreceptionai.com