Security
Security that refuses rather than guesses
This page describes the controls built into the platform, and says so where one is planned. Where the platform cannot confirm that something is allowed, it refuses it.
Controls in the platform
Tenant isolation
Every account's rows sit behind row-level security that the database enforces, and every request runs inside its own account's scope. Automated tests try to read across accounts on every table.
Accounts
Multi-factor authentication with an authenticator app is required for administrators and can be required for everyone. Recovery codes work once; repeated failures lock the account.
IP allow-lists
Separate allow-lists for the console and the API, per account.
Secrets
Channel and provider credentials are kept as references to secrets held outside the application database, never as values in it. A secret vault, so that credentials can be typed into the console, is planned. MFA secrets are encrypted with AES-256-GCM.
Webhooks and the API
Scoped API tokens, never accepted in a URL. Webhooks are signed with HMAC-SHA-256 and a timestamp, sent only to https addresses on the public internet, and never follow redirects.
Spend and fraud controls
Usage is prepaid and capped. A call is limited before it starts; high-cost number ranges are always refused; a control that cannot decide refuses.
Honest calling
Calls present only the account's own verified numbers. There are no number pools and no caller-ID rotation.
Governed AI
The AI agent discloses itself, sensitive values are masked before a request leaves, spending is capped per month, and AI output is labelled. AI scores about agents are advisory and reviewed by a person.
Retention
Retention periods per dataset, purged daily with a record of every run. One-time codes are never stored in clear text anywhere.
Where data lives
Customer data is hosted in the European Union. Each account's data is reachable only inside that account's scope, and act-as access by a reseller or by us for support is audited.
Audit records cover configuration changes, act-as sessions and reviews.
Audits and certifications
We do not hold third-party security certifications yet. When an audit or certification is completed, it will be listed here with its scope and date.
Reporting a vulnerability
If you believe you have found a security vulnerability, e-mail security@ringura.com with the issue, the steps to reproduce it and what an attacker could do with it. Our contact details are also in security.txt.
- We acknowledge a report within 3 working days, and confirm or rule out the issue with a planned fix date within 10 working days.
- We keep you informed until it is fixed, credit you if you wish, and do not pursue legal action against good-faith research that follows these rules.
- Test only against accounts you own or may test. Do not access other people's data, degrade the service, or call or message numbers you do not own.
- Give us 90 days to fix an issue before you publish it, or less if we agree.
Security questions for your review?
We will answer your questionnaire.