Security
Last updated: 30 October 2026
Tagloud checks phone calls that often contain personal and sometimes sensitive information. We built it so that the most sensitive data is never kept, and what we do keep is locked down.
Sensitive information is removed, not stored
- Social Security and other national ID numbers, card numbers, CVVs and expiry dates, bank account and routing numbers, passport and health plan numbers, PINs, email addresses and dates of birth are removed while the call is transcribed. A second check removes anything that slips through before the transcript is saved.
- We never store call recordings. We read them from your call platform only to transcribe them.
Caller numbers
- The full caller number is encrypted (AES-256-GCM) the moment a call reaches us, before it is written anywhere.
- Everyone, including our own team, sees only the last 5 digits, for example •••••50148. Exports show the same.
- Repeat callers are spotted with a keyed one-way code, so no number has to be decrypted to do it.
- The full number is used in only two places, both inside the server: hashed (SHA-256) audience files for Google and Meta, and qualified-call conversions you choose to send to your own Google Ads account.
Encryption
- All traffic uses HTTPS (TLS).
- Transcripts, raw call data and AI evidence quotes are encrypted on our servers. Integration keys and secrets are encrypted too.
- Passwords are stored as salted scrypt hashes. Deleted data is overwritten in the database file.
Retention
- Each account chooses how long call details are kept: 30, 60, 90 (default), 180 or 365 days. After that, the transcript, raw data, recording link, evidence quotes and encrypted caller number are deleted every night.
- Daily backups are encrypted copies of the same data, kept for 14 days and then deleted.
- Security logs are kept for 12 months.
Access
- Each customer sees only their own data.
- Staff access is limited to support and is password protected. Every time staff open a customer's calls or campaigns, it is logged and shown to that customer under Account → Security activity.
- Sign-ins, failed sign-ins, password changes, exports and integration key changes are logged as well.
If something goes wrong
We follow a written incident response plan. If a security incident affects your data, we tell you without undue delay and within 72 hours of confirming it, report to India's CERT-In within 6 hours as Indian law requires, and give you what you need for any notices you must send.
Agreements
A Data Processing Agreement (DPA) is available for every customer. Our current subprocessors are listed on the Subprocessors page. To request the DPA or report a security issue, contact hello@tagloud.com.