Report a security problem

If you think you’ve found a security vulnerability in Telephonist, please email support@telephonist.ai with “Security” in the subject line. Tell us:

  • what you found, and where: the web address, phone number or feature;
  • the steps to reproduce it, and what someone could do with it;
  • how we can contact you.

Please don’t send us anyone’s personal data. If you saw some, describe it instead. If you need to send us something sensitive, say so in your first email and we’ll agree a secure way to share it.

What this covers

This policy covers the telephonist.ai website, including account, checkout and billing pages; Telephonist phone lines and text replies, and the systems behind them; Telephonist ID, including call signatures and Check a call; and the Telephonist iPhone app.

It doesn’t cover the services we rely on, such as Cloudflare, Twilio, OpenAI and Revolut. Please report problems in those to the provider directly.

Research in good faith

  • Only use accounts and phone numbers that are yours, or that you have permission to use.
  • Don’t access, change or delete data that isn’t yours. If you reach someone else’s data, stop and tell us what you saw.
  • Don’t call or text people who haven’t agreed to it, and don’t run up charges on anyone’s account.
  • Don’t disrupt the service: no denial-of-service attacks, spam or high-volume automated testing.
  • Don’t use social engineering, phishing or physical attacks against our team, our customers or our providers.
  • Give us reasonable time to fix the problem before you tell anyone else about it.

What we promise

  • We’ll acknowledge your report within 5 working days.
  • We’ll look into it, tell you what we’re going to do, and let you know when it’s fixed.
  • If you act in good faith and follow this policy, we won’t take legal action against you for your research or your report.
  • We don’t run a bug bounty, so we don’t pay for reports.

Support and updates

Telephonist is a hosted service: it runs on our servers, not on your devices, so everyone uses the current version. We update it continuously, and security fixes reach every customer as soon as we release them. There’s nothing for you to install. If you use the Telephonist iPhone app, install updates when your iPhone offers them.

We act on security advisories for the software Telephonist is built on within 14 days, or within 3 days if they’re critical.

We support Telephonist, including security fixes, for as long as we offer it. It has no end-of-support date. If we ever decide to stop offering Telephonist, we’ll give you reasonable notice where we can, explain what it means for you and give you a fair way to stop using it, as our terms set out.

Most security fixes need nothing from you, so we apply them without notice. If a vulnerability or a fix affects your account or your data, or you need to do something, we’ll email your account’s email address to tell you what happened and what, if anything, to do.

You sign in to Telephonist with a code or link we email you, so keep that mailbox secure with a strong password and two-step verification. If you think someone else has got into your account, email support@telephonist.ai straight away.

If there’s an incident

If we become aware of a personal data breach affecting your data, we’ll tell you without undue delay, and within 24 hours, with what we know and what we’re doing about it, and we’ll keep you updated. This promise is part of our data processing terms.

If a problem stops Telephonist answering your calls or sending your call summaries, we’ll tell you by email or phone, explain what your callers will notice and what you can do in the meantime, such as forwarding your number to your own phone, and keep you updated until it’s fixed.

To report an incident or ask about one, email support@telephonist.ai.

More about how we protect data

Our privacy notice sets out the security measures we use and who processes data for us. Our security contact details are also published in machine-readable form at telephonist.ai/.well-known/security.txt.

We’ll review this page within 12 months, or sooner if the service changes significantly.