Written for the person who has to sign off on the purchase, not for a security team. Everything below describes how the service is built today.
1. Data in transit
Every connection to nexgencall.com is served over TLS, with HTTP redirected to HTTPS at the edge and HTTP Strict Transport Security set. Traffic reaches the application through Cloudflare, which terminates TLS, filters at the edge and absorbs volumetric attacks. The application itself binds to a private address and is not reachable directly from the internet.
2. Data at rest
- Secrets are encrypted. Your Twilio auth token, and any other third-party credential you connect, are encrypted with AES-256-GCM before they are written to the database. The key lives in the application environment, not in the database, so a database dump on its own does not yield working credentials.
- Passwords are never stored. We store a salted, iterated PBKDF2-SHA256 derivation. We cannot read your password and we will never ask you for it.
- Two-factor authentication is available on every plan, with time-based codes and single-use recovery codes. Enabling or disabling it revokes every other signed-in session.
- Recordings are held in your own Twilio account, under your own Twilio credentials.
3. Separation between customers
Every workspace is a tenant, and every query that reads call, number, message, contact or report data is scoped to the tenant of the signed-in session before it runs. The tenant is taken from the signed session cookie on the server, never from a value the browser can set. API keys are bound to one workspace and carry the same scoping.
4. Who can reach production
Production access is limited to the people who operate the service, over key-based SSH, for support and incident response. Security-relevant actions inside a workspace, such as password changes, credential updates, number releases and role changes, are written to an audit log that names the user who performed them.
5. Backups and recovery
The database is backed up nightly, encrypted, and copied off site to Backblaze B2 in addition to the primary provider. Restores are rehearsed against a scratch database rather than assumed to work. Backups follow the same retention windows as the live data.
6. Subprocessors
These are the third parties that can hold customer data on our behalf. Each is contractually bound to protect it and to use it only to provide its service to us.
| Subprocessor | What it does | Location |
|---|---|---|
| Twilio | Telephone numbers, call carriage, recording storage and SMS delivery. | United States |
| Stripe | Subscription billing and card processing. Card numbers reach Stripe directly and are never stored by us. | United States |
| DigitalOcean | Application servers, database and object storage. | United States |
| Cloudflare | DNS, TLS termination, CDN and edge filtering. | United States |
| Backblaze B2 | Encrypted off-site backups of the database and stored files. | United States |
| Deepgram | Speech-to-text transcription of call recordings, when call transcription is enabled for the account. | United States |
7. Application hardening
- State-changing requests are checked for same-origin provenance, and the session cookie is HttpOnly, Secure and SameSite=Lax.
- Sign-in, password reset, sign-up and promotional code checks are rate limited per address, and password reset answers identically whether or not the account exists.
- Sessions carry a version number: changing a password, turning two-factor on or off, or revoking sessions invalidates every cookie issued before that moment.
- Inbound telephony webhooks are verified against Twilio's request signature before they are acted on.
8. What we do not claim
We would rather tell you this than have you find out later. Nexgen Call has no SOC 2 report, no ISO 27001 certificate, and no HIPAA business associate agreement on the published plans. There is no contractual uptime commitment and no service credit scheme. If your procurement process requires any of those, talk to us before you buy rather than after.
9. Reporting a vulnerability
Email [email protected] with the subject line "Security". Include what you found, how to reproduce it and what you think the impact is. We will acknowledge within two business days and keep you updated until it is closed. Please give us a reasonable window to fix an issue before you publish it, and do not access data that is not yours while testing.