Security overview

• The service, its API and the database run on servers of OVHcloud in Poland (EU).
• The voice agent, speech recognition and speech synthesis run on GPU servers that we rent and operate ourselves; speech is recognised and synthesised by models we run, not by third-party speech services.
• Call recordings are stored in Cloudflare R2. The voice servers never hold the storage keys: they receive a one-off upload link valid for 15 minutes. Recordings are played in the dashboard through links that expire after an hour.
• The full list of providers is on the Sub-processors page.

• All connections to the website, the dashboard and the API are encrypted (HTTPS/TLS).
• Passwords are stored only as salted hashes, never in readable form.
• Secrets we must keep — for example access tokens of a connected Google Calendar and the passwords of SIP lines — are stored encrypted.

• Each business works in its own workspace and sees only its own agents, calls, requests and data; every request to the API is checked against the workspace of the signed-in user.
• Sign-in creates a session in a secure, httpOnly cookie that scripts on the page cannot read; it expires after 30 days or at sign-out. Repeated failed sign-in attempts are limited.
• Administrative access to the servers and the database is limited to Individual Entrepreneur Aleksandra Ilina. A contractor engaged for specific work gets only the access that work needs and is bound by confidentiality.
• We do not routinely listen to calls. We look at a specific call only to resolve a support request from the business or to investigate suspected abuse.

• Audio recordings are deleted automatically 90 days after the call.
• A business can delete any call, with its recording and transcript, from the dashboard.
• Call recordings and transcripts are never used to train AI models.
• The agent never takes payments and is not set up to ask for card numbers, passwords or codes.

Before updates of the service we make a copy of the database, so that an update can be rolled back. These copies are kept for up to 30 days. We test updates before releasing them and release them preferably at night, Tbilisi time.

If a security incident affects personal data, we notify the affected business customers without undue delay and no later than 48 hours after we become aware of it, as set out in the Data processing agreement, and the Personal Data Protection Service of Georgia where the law requires it.

• use a strong, unique password or sign in with Google;
• give dashboard access only to people who need it, and remove it when they leave;
• connect only the integrations you need, and disconnect those you no longer use;
• set up the agent to collect only the data needed for your callers’ requests.

If you find a security issue in Diallo, write to envmotion@gmail.com with a description and the steps to reproduce it. Please do not access other people’s data, disrupt the service or publish the issue before we have fixed it. We confirm receipt, keep you informed and thank everyone who reports in good faith.