Security
How Tried protects your calls and data.
Tried handles phone calls, recordings and transcripts that often contain personal information. Every control on this page is in the product today.
Tenant isolation
One customer must never see another's data.
Separate workspaces
Every record belongs to one workspace, and every request is checked against the workspace of the person or key making it.
Random IDs
Agents, calls and keys get long random identifiers, so nothing can be guessed or counted.
Authentication and access
Who can reach the dashboard and the API, and what they can do there.
API keys shown once
Keys are shown once, stored only as a hash, then displayed masked. Creation and deletion are recorded.
Roles
Admin, developer and member roles, checked on every route.
Secure sessions
Dashboard sessions use signed, browser-only cookies, and requests that change data are checked against the site they came from.
Short-lived call access
Each call gets its own audio access pass, valid for that one call for an hour, with only the permissions it needs.
Data protection
Recordings and transcripts are the most sensitive data we hold.
Per-agent storage modes
Keep everything, keep everything except personal details, or keep only basic call information with no transcript or recording.
Recording deletion
Recordings are deleted 30 days after a call by default. Workspaces can choose to keep them for 90, 180, 365 or 730 days.
Encrypted customer secrets
Passwords and keys you give us for your own systems and phone lines are encrypted one by one, can be replaced but never read back, and are never shown again.
Webhooks, functions and tools
Agents call your systems, and we call you back. Both directions are verifiable.
Signed webhooks
Every event we send you is signed with a key unique to your workspace and stamped with the time, so you can reject anything forged or replayed.
Signed function requests
Requests from the agent to your endpoints carry a signature you can check.
Input checks
Every request is checked against what the endpoint expects, unknown fields are dropped, and size limits apply.
Phone fraud
Phone systems attract fraud. Limits are on by default.
Limits on calls at once
Each workspace has a limit on calls at the same time, with optional lines kept for incoming calls.
Country limits
Each number has its own list of countries it can receive calls from and call out to.
Report a vulnerability
Email security@tried.com.au with steps to reproduce.
Questions about how Tried handles your data?
Ask us. We will tell you exactly what the product does today.