Ryffio
Security controls for voice calls
Review the controls, data handling and current limitations before you put customer calls on Ryffio.
Encrypted secrets
Provider credentials are encrypted at rest; API keys are stored only as hashes.
Strong sign-in
Authenticator-app MFA with recovery codes, enforceable for a whole organization.
Audit trail
Sign-ins, key and credential changes, and data access are recorded for admins.
HIPAA mode
No transcripts or recordings kept, covered providers only, payloads out of logs.
How your data is handled
Isolation and access
- Every record belongs to one organization; requests are scoped to the caller's organization and checked on every read and write
- Roles: admin, editor and viewer. Keys and billing are admin-only
- Sessions can be listed and revoked, and you can sign out everywhere
- Passwords are hashed with Argon2; reset and email-verification links are single-use and expire
- Sign-in is throttled per address and per account, with lockout and backoff after repeated failures
Credentials and keys
- Your provider credentials are encrypted with AES-256-GCM under a key held outside the database, with support for rotation
- Private API keys are shown once and stored as SHA-256 hashes, so a database leak does not reveal them
- Public keys can only start calls and read assistants
- Requests Ryffio makes to your URLs are limited to public HTTPS endpoints, so a tool can't be aimed at an internal network
Transport and application hardening
- TLS everywhere, with HSTS and a content security policy on the dashboard
- Request-size limits, rate limits and a captcha option on sign-up
- Webhook signatures verified in constant time, with a replay window
- Dependency advisories are checked in CI for both the backend and the dashboard
Your data, your control
- Export a user's or an organization's data at any time
- Delete a call and its audio goes with it; set a retention period for recordings
- Delete your account; organizations you alone belong to are removed with their data
- Store recordings in your own S3-compatible bucket and serve them by short-lived signed link
Privacy controls for regulated conversations
An organization can switch on HIPAA mode. It changes how the platform behaves, and it refuses to turn on until the preconditions are met.
Software cannot supply the contracts. Using Ryffio for protected health information also needs a signed agreement with Ryffio and with every provider on the call path, and your own policies. Ask your counsel.
- Enabling is gatedRyffio lists the providers it holds agreements with, and the admin enabling it must have MFA on.
- No retentionNo recordings, and no transcript, messages, summary or extracted data on the call record.
- Covered providers onlyCalls may only use speech, model and voice providers on that list.
- MFA for everyoneEvery member of the organization must enrol before getting access.
- Logs without payloadsAPI and webhook logs record that a request happened, not what it carried. Reading a call is audited.
Guardrails for the calls themselves
Consent
Outbound campaigns require recorded consent for each customer by default; people without it are skipped and the result says why.
Do not call
An organization-wide do-not-call list always wins, whatever a campaign says. Changes to it are audited.
Calling hours
Each campaign has a calling window in the customers' time zone; calls outside it wait.
Recording notice
Speak a recording announcement before the greeting, set per assistant or for the whole organization.
Human hand-off
Transfer to a person whenever the conversation needs one.
Failure handling
If a provider fails, the caller hears an apology and the call ends with a clear reason. Monitors alert your team.
Where your data goes
These providers can receive customer or caller data when you enable the feature that uses them. Remove the ones you don't use by not configuring them.
| Provider | Purpose | Data |
|---|---|---|
| OpenAI | Language model, speech recognition, voice | Caller audio, transcripts, prompts |
| Google Cloud (Gemini on Vertex AI) | Language model, speech recognition, voice | Caller audio, transcripts, prompts |
| Cloudflare | WebRTC media relay, captcha, edge network | Live call media, captcha signals, web traffic |
| Twilio | Phone numbers and calls | Call audio, phone numbers |
| Resend | Transactional email | Recipient addresses, message content |
| Object storage (S3-compatible) | Recordings, when you enable it | Call audio |
| Hosting provider | Servers and database | Everything at rest |
Production runs in the United States (US East). Other regions are not available yet.
Current limitations
Review these limitations before an enterprise evaluation.
- We have not completed a SOC 2 or ISO 27001 audit
- We have not yet had an independent penetration test
- No EU or other regional hosting yet; data is processed in the United States
- Single sign-on uses OIDC rather than native SAML; SCIM provisioning is implemented. Validate both with your identity provider during evaluation
- No uptime guarantee yet
Questions about your requirements?
Review the privacy policy and provider directory, or discuss your requirements with the Ryffio team before an enterprise evaluation.