Security

What happens to your leads, calls and logins on SolarDialer, in plain words. Nothing on this page is a certification: we don't hold SOC 2, ISO 27001 or HIPAA attestations. It says what the service does today.

Where it runs

• The application and its database run on Amazon Web Services (Lightsail), in the US West (Oregon) region.
• The database is on the same server and isn't reachable from the internet: only the application talks to it.
• Calls are carried by our calling and phone providers; see the subprocessor list.

In transit

• The site is served over HTTPS only, and browsers are told never to use plain HTTP (HSTS).
• Our connections to calling providers, CRMs and Google use HTTPS too.

Logins and sessions

• Passwords are stored only as a salted scrypt hash, never in readable form.
• After 10 wrong passwords from one address, an account is locked to that address for 15 minutes, so a password can't be guessed by trying many, and no one else can lock you out.
• A session is a signed cookie (HttpOnly, Secure, SameSite=Lax) that lasts up to 14 days. Logging out, or setting a new password, ends every session of the account on every device.
• Password reset codes expire, allow only a few tries, and are stored only as a keyed hash.

API keys and connected tools

• Your lead API key is shown to you once. We keep only its SHA-256 hash and its last four characters, so it can't be read back from our database.
• Access tokens and API keys you give us for CRMs, calendars and texting providers are encrypted at rest with AES-256-GCM. The key is kept in the server's protected configuration, not in the database. They are never logged and never shown back, even to you.
• Disconnecting a CRM deletes its tokens and the links between its contacts and your leads.

Recordings and transcripts

• Every call is recorded and transcribed. Recordings are stored by the providers that carried the call (our calling platform, and our phone provider for the closer's part of a transferred call) and played through our site.
• Who can see them: your own account, and the people who run SolarDialer, only to operate, secure and support the service. Each account sees only its own leads, calls and connections.
• If you connect a CRM, the call notes we write there carry a link to the recording. That link plays without a login, so anyone who can read the note can play it. It is signed so it can't be guessed or changed to another call.

When our staff open your account

• For support, a SolarDialer admin can view the site as your account. Each time is logged: when it started, every change made while viewing, and when it ended. A view ends on its own after 2 hours.

How long we keep data

• Leads, calls, recordings and transcripts are kept while your account is open, unless you or the law ask otherwise.
• The log of events sent to your connected tools is kept 90 days.
• Records of visits to this website (pages opened, browser, IP address) are kept 180 days.
• Do-not-call requests are kept for good, by phone number, so they keep working for every account.

Deleting your data

• Write to info@solardialer.net from your account's email address to have your account or its data deleted. The Privacy policy says what is deleted, what has to be kept (billing records, the do-not-call list) and how soon.
• When an account is deleted, its logins and API key, leads, texts, connected tools and their tokens, and its own carriers and phone numbers are removed, and its campaigns stop. Its calls' transcripts, AI summaries, recording links and the numbers called are deleted at once, and the recordings themselves at our calling platform and our phone provider within a day. Only what each call cost and was charged, its length, time and result stay, for the books.
• Recording links already written into a CRM stop playing when the account is deleted. The notes themselves stay in the CRM: delete them there.

If something goes wrong

If we learn that someone got unauthorized access to your data, we will tell you without undue delay, with what happened and what we are doing about it. To report a security problem, write to info@solardialer.net.

See also: how the agent identifies itself and the Data Processing Addendum.