Security and your data

Plain answers about your data.

What Callra keeps, what it never touches, who else processes a call, and the certifications we don't have yet. No badges we haven't earned.

Create your account ✉ Ask us: info@callraai.com

Claims last reviewed

What Callra keeps

  • Names and phone numbers
  • Orders and appointments
  • Call transcripts
  • Recordings, when disclosed
  • Your menu, services and team
  • Payment tokens and last 4

What Callra never holds

  • Full card numbers
  • Card security codes
  • Clinical records
  • Anything we would sell

— Certifications, honestly

We're young, and we don't hold formal certifications yet.

Here's exactly where things stand. When an audit is finished, its real result goes here, and not before.

Card paymentsThrough PCI-compliant processorsStripe, Converge (Elavon), Clover or Square take the card on their own hosted page. Callra never sees the number.
Data locationUnited StatesThe app, calls and stored data run on U.S. infrastructure.
EncryptionIn transit and at restConnections are encrypted, and POS sign-in tokens are encrypted again before they are stored.
SOC 2 · ISO 27001Not certifiedNo audit has started. We will say so here when one does.
HIPAANot certifiedDental practices: Callra stores appointments only, never clinical records.
Penetration testingNo scheduled program yetOn the roadmap as the company grows.

— Where a card number goes

Never through us.

On a phone order, the guest is never asked to read out a card. They get a secure link, and the card goes straight to your payment provider.

  1. Guest orders by phoneCallra takes the order. No card is asked for or said aloud.
  2. Gets a pay link by textA link to your payment provider's own checkout page.
  3. Pays on the provider's pageStripe, Converge, Clover or Square takes the card. This is the only place it goes.
  4. Callra gets a receiptPaid or not, plus a token and the last 4 digits for refunds.

Salons and dental practices: there's no payment step at all. Callra doesn't take deposits or cancellation fees, so it never touches a card for you.

— Recording and AI disclosure

Callers are told, and it never lies about it.

  • A recording notice in the greetingOn by default, in your business's language. You can switch it off where the law allows.
  • It says it's an AIAnnounced in the greeting if you want, and never denied when a caller asks.
  • Honest about transcriptsText transcripts are kept for every call, so the agent never claims a call isn't recorded.

Some U.S. states require everyone on a call to agree to recording. This isn't legal advice: confirm your own state's rules with your counsel.

The first five seconds

CallraHi, thanks for calling Mario's Pizza. This call will be recorded. How can I help?

CallerWait, am I talking to a real person?

CallraNo, I'm an AI assistant for Mario's. I can take your order, or put you through to the team.

— Who else touches a call

The services that make it work.

To answer a call, the audio and transcript pass through a small set of providers. Owners agree to this when they set up the agent. We don't sell your data, and we only share what a call needs.

  • LiveKitCarries the call audio
  • DeepgramTurns speech into text
  • Google GeminiUnderstands and replies
  • ElevenLabsTurns replies into a voice
  • TwilioPhone numbers and texts
  • Your payment providerTakes the card, when there is one

— What each business stores

Different desks, different data.

  • Restaurants

    • Orders and the menu they were taken from
    • Guest names, numbers and addresses
    • Payment tokens and last 4, never the card
    • POS sign-in tokens, encrypted

    Card details go to your payment provider's page and nowhere else.

  • Salons & barbers

    • Appointments, services and stylists
    • The client book and visit history
    • Patch-test records that can't be edited over
    • No card data, because there's no payment step

    A correction to a patch test is added as a new entry, so the history stays intact for your insurer.

  • Dental practices

    • Appointments, treatments and dentists
    • Patient names and phone numbers
    • A short note your team adds
    • No clinical records: there's no field for one

    It gives no clinical advice, and calls that sound like an emergency are sent to urgent care, not booked.

Security FAQ

Straight answers.

Payments, certifications, where data lives, recording, and who else processes a call.

Let it
ring.

Create your account and set it up in the app, free. It starts answering your phone the moment you pick a plan.