Callbrook
Security
What this system actually does to protect calls and customer data. Only measures that are implemented are listed.
Template — not reviewed by a lawyer
Legal counsel must approve the Terms, Privacy Policy, call-recording disclosure, data-processing terms and jurisdiction-specific telecommunications requirements before this service takes real customers.
Protecting caller data
Caller telephone numbers, caller email addresses and notification destinations are encrypted with AES-256-GCM before storage. Keys are derived per purpose with HKDF from a single secret held in the environment, so the key that signs a session cookie cannot decrypt a caller's number.
Call recording is disabled by default at the voice provider. Transcripts have a configurable retention period and are deleted automatically when it expires.
Logs are redacted at the point of writing. Telephone numbers, email addresses, API keys and long tokens are replaced before a line is emitted.
Protecting the application
A Content Security Policy with a per-request nonce, HSTS, frame denial, MIME sniffing protection and a restrictive permissions policy are applied to every response.
Session cookies are signed, httpOnly, SameSite=Lax and secure in production. Sign-in uses single-use email links, stored only as hashes, that expire in 15 minutes.
Sign-in responses are identical whether or not an account exists, so the endpoint cannot be used to discover customers.
Protecting against abuse
The website importer resolves every host and refuses any address that resolves to a private, loopback, link-local or cloud-metadata range, and re-checks on every redirect. Bare IP addresses, non-standard ports, credentials in the URL and non-web protocols are rejected.
Every expensive action is rate limited by address, by domain and globally at the same time. Demonstration calls are additionally limited per session and hard-capped at two minutes by the voice provider itself.
Numbers the system may dial are validated against an allowed-country list with emergency, premium-rate and revenue-share ranges blocked.
Inbound webhooks are verified by HMAC over the raw body, rejected outside a 30-minute window, and recorded by event id so a replay cannot cause a second email or a duplicate record.
What we do not claim
We hold no security certification and claim none. There is no SOC 2 report, no ISO 27001 certificate and no HIPAA attestation. If you require one, we are not currently the right supplier, and we would rather tell you that here than in a procurement questionnaire.
To report a vulnerability, email support@callbrook.co.uk. We will acknowledge it and we will not pursue anyone who reports one in good faith.