Security
Your calls, your customers, your data.
What we store, how it is protected, who else touches it, and how long it lives. Plainly, including what we do not have yet.
Card numbers never reach us
The agent never takes a card number over the phone, and no SwaraOS page has a card field. Guests pay on Stripe’s own checkout page, from a link we text them or from your online store. Stripe holds the card; SwaraOS only learns whether the payment went through.
Encrypted, field by field
Everything travels over HTTPS. On top of that, the most sensitive things we store are sealed with AES-256-GCM before they reach the database: call and chat transcripts and their summaries, the messages the agent takes for you, text message bodies, and the patient details a clinic collects (name, date of birth, medication, insurance member ID).
The keys you give us to connect your tools, such as your POS or calendar, are encrypted the same way and are never shown back in full.
Your business is its own workspace
Each business has its own workspace and its own number, and everything the agent reads or writes is scoped to that business. Staff sign in to see it, and a caller can only look up their own order or booking.
Who processes a call
SwaraOS does not train any AI model on your calls or your customers’ data. To answer a call, the audio and text pass through the speech, language and voice providers listed in our privacy policy, which process them to deliver the service under their own terms. Telephony, payments and hosting providers are listed there too.
How long we keep it
We keep your data while your account is active. You can ask for a retention window: transcripts older than it are then permanently deleted every night. You can ask us to delete your data at any time.
The database is backed up nightly to private storage, and a backup that fails alerts us the same night.
Calling and texting your customers
Every text sent on your behalf is checked against your do-not-call list first, and a customer who replies STOP is added to it. Scheduled calls and texts, such as appointment reminders and win-backs, only go out in daytime hours in the recipient’s own time zone.
What we do not have yet
We do not hold a SOC 2 report or any other security certification today. If your business needs one, a data-processing agreement, or answers to a security questionnaire, write to hello@swaraos.com and we will tell you exactly where we stand.