Trust Centre
Security You Can Check, Not Just Trust
Here is how Call Caddie protects your data today, what is on our roadmap, and what we do not claim. We would rather be precise than impressive.
In Place
How Your Data Is Protected
Tenant Isolation
Every organisation's data is separated by database row-level security, enforced on every request, plus server-side permission checks. A missed filter still cannot expose another customer's data.
Encrypted Secrets
Integration credentials and tokens are encrypted at rest with AES-256-GCM. They are never sent back to the browser and never written to logs.
Encryption in Transit
All traffic between your browser, our service and connected systems uses TLS.
Strong Sign-In
Passwords are hashed with Argon2id. Multi-factor authentication with an authenticator app, plus sign-in with Microsoft or Google.
Audit Log
Material changes, sensitive actions and customer-impacting automation are recorded with who, what and when.
Least Privilege
Granular roles and permissions. Reps see only what they need, and IT admins can manage integrations without seeing call content.
Roadmap
What Is Coming, Stated Plainly
These items are planned. They are not available yet, and we will not claim them until they are.
| Item | Status | Notes |
|---|---|---|
| SAML single sign-on | Coming soon | Architected for Enterprise. Microsoft and Google sign-in are available now. |
| SCIM user provisioning | Coming soon | Architected for Enterprise. |
| Data residency options | Coming soon | Regional hosting choices for Enterprise customers. |
| SOC 2 Type II | Coming soon | Roadmap. Call Caddie is not SOC 2 certified. |
| ISO/IEC 27001 | Coming soon | Roadmap. Call Caddie is not ISO 27001 certified. |
| Independent penetration test | Coming soon | A summary will be added to the Security Pack once commissioned. |
Procurement
The Security and Procurement Pack
Everything a security or procurement team usually asks for, in one place. The pack is available on request while we prepare the self-service download.
- Standard security questionnaire
- Architecture and data-flow diagram
- Subprocessor list with regions
- Data Processing Agreement
- Data retention and deletion summary
- Backup and recovery statement
- Incident response summary
- Integration permission register
Subprocessors
Subprocessors
Third parties that may process customer data on our behalf. Customers are told when this list changes.
To be confirmed. This list is a placeholder and will be finalised before general availability.
| Service | Purpose | Region |
|---|---|---|
| Cloud hosting provider | Application hosting and database | To be confirmed |
| Email delivery provider | System email such as invitations and alerts | To be confirmed |
| Payment provider | Subscription billing | To be confirmed |
| Live call transcription | Runs on the rep's own computer: call audio is never sent to Call Caddie or any other company. Only the transcript text is saved with your account. | Not applicable (on the rep's computer) |
| AI | None. Highlights, suggested scores and compliance alerts are worked out on the rep's own computer, and Call Caddie does not send your data to an AI company. If you connect Call Caddie to your own AI assistant (such as Claude or ChatGPT), that assistant works under your own agreement with its provider. | Not applicable |
Report a Security Concern
If you believe you have found a security issue, please email info@sgopeoplehub.com with the details. We will acknowledge your report and keep you informed.