Your business communication data deserves serious protection
Call activity can contain sensitive customer and employee information. Security therefore cannot be an afterthought.
Encryption in transit
The Android app and console talk to CallTrackly over HTTPS. Release builds of the app refuse unencrypted connections.
Secure authentication
Passwords are hashed with bcrypt. Sessions use short-lived access tokens with rotating, revocable refresh tokens, and sign-in endpoints are rate limited.
Organization isolation
Every operational record is scoped to its organization and checked on each request to prevent cross-tenant access.
Role-based access
Administrators, managers and employees see different information, and organizations decide which features employees can use.
Auditability
Important administrative and security-sensitive actions are written to an audit history for review.
Controlled file access
Synced recordings are encrypted at rest and only playable by authenticated, authorized users. Device sessions on the phone use an Android Keystore-backed key.
Responsible data retention
Organizations set a recording retention period; expired recordings and their transcripts are deleted automatically.
Transparent deployment
CallTrackly is intended for legitimate business use with appropriate employee disclosure. Only the selected business SIM is tracked, and recording sync is off by default.
Secure technology still needs responsible operation
Organizations control who is enrolled, which SIM is used, whether recordings are synchronized, who can play them, and how long operational data is retained.
Administrators should give workforce notices, obtain recording consent where required, remove departed employees promptly, and limit access to people with a business need.
Talk to us about security
We can share deployment-specific architecture details, configured subprocessors and a data processing addendum for qualified customers.