Security and data handling

An email address, and nothing else about you at signup. Sign-in is a one-time link sent to that address, or Google. There is no password to store because the product has none, and if you use Google we receive your email address and name and never a credential.

For each call: the number dialled, when it started and ended, how long it ran, what it cost, and how it ended. For each payment: the amount and the Stripe reference. Contacts only if you save them. Text messages sent to a number you rent are stored so you can read them.

Call audio is not stored. The exception is an account that has deliberately turned recording on, covered below.

Card details. Payment runs on Stripe Checkout, hosted by Stripe on their own page. Card numbers are entered there and never reach our servers, so there is no card data here to breach.

Passwords. There are none in this product.

Postgres, managed by Supabase, in AWS us-west-2 (Oregon, United States). The application runs on Railway with Cloudflare in front of it. Backups stay inside that Supabase project.

The company behind the product is EchoForge, run from Jakarta, Indonesia. If the data being stored in the United States matters to your process, that is the fact to take into your review, and it is on the privacy policy as well.

Access is enforced by the database, not by the application. Every table carries row-level security, so a query that should return nothing returns nothing even if the code asking for it is wrong.

On a team, a member sees their own calls and their own spend. An admin sees the account. That split is a database policy rather than a filter in a page, which is what makes it hold on every route at once.

The key that ships to your browser can write exactly one table, your own saved contacts. On the other twenty-two it holds no insert, update or delete permission at all, so it cannot change a spend cap, lift a limit, unfreeze an account or touch the money ledger. The ledger is additionally append-only at the database level: entries can be added and never rewritten or deleted, including by us.

This is the claim most worth checking, so here is the mechanism. Our error reporting runs every payload through a scrubber that redacts anything phone-shaped, and it covers errors, performance traces and logs rather than errors alone, because a trace carries the URL it was recorded on.

Product analytics receives the destination country and the price band. It does not receive the number, hashed or otherwise. Automatic click capture and session replay are both switched off in code rather than in a vendor dashboard, so nobody can turn them back on by clicking something: a replay of this product would be a video of somebody typing a phone number and then talking to whoever answered.

The contents of text messages sent to a rented number are never logged and never sent to any third party. They are the most sensitive thing here, because they are frequently bank passcodes.

The full list. A vendor is on it because the product cannot work without it, and each line says what it actually receives.

Supabasedatabase and sign-in

Everything the product stores: your email address, your calls, your ledger, your contacts. Hosted on AWS in us-west-2 (Oregon, United States).

Railwayapplication hosting

Runs the application itself. Data in transit through it, nothing stored there.

CloudflareDNS and edge

Sits in front of the domain, so it sees request metadata including your IP address and the page you asked for. It does not see call audio.

Stripepayments

Your card details, entered on a page Stripe hosts, plus your email and any tax ID you choose to give. Card numbers never reach our servers.

Telnyxcarrier

The number you dialled, for calls it carries. It is a licensed carrier and needs the number to connect the call. Also carries rented numbers and their incoming texts.

Twiliocarrier

The number you dialled, for the minority of destinations it carries rather than Telnyx.

Vonagecarrier

The number you dialled, for the minority of destinations it carries rather than Telnyx.

Brevoemail delivery

Your email address and the message itself, for sign-in links and team invitations.

PostHogproduct analytics

The destination country and price band of a call, never the number. Automatic click capture and session replay are switched off in code.

Sentryerror reporting

Crash reports, with anything phone-shaped redacted before the report leaves your browser or our server.

Ahrefsweb analytics

Page views on public marketing pages only. It is not loaded on the dialer, your history, your contacts or your account.

DeepInfratranscription

Nothing, unless your account has turned call recording on. Where it has, the recorded audio, to transcribe and summarise it.

Telegramoptional alerts

Nothing, unless you deliberately link a chat. Where you have, the alerts you asked for.

Recording is off by default and is not something an individual caller can enable. Only an account admin can switch it on, because it is a legal position taken for the company.

Where recording is on, a spoken notice can be played to the person you called. A caller may turn that notice on for their own call and can never turn it off, and any caller may decline to record a call. An admin cannot force recording onto a colleague who has declined, and that direction is deliberate rather than unimplemented.

While a call is being recorded, the person making it sees an indicator on their own screen for the whole call, and can stop the recording mid-call without ending the call. What was captured before that point is kept; nothing further is captured.

Recordings are transcribed and then the audio is deleted by default. Consent is your responsibility as the account holder, and the laws differ by country and by US state. We give you the switch and the spoken notice; we do not give you legal advice about when to use them.

Credit is prepaid, so the most an account can lose is what is on it. Each person on a team can be given a monthly cap, and the cap is checked when they press Call rather than reported at the end of the month, so it prevents spend instead of describing it.

Ranges that exist to bill the caller heavily are refused rather than priced. Spend ceilings are enforced twice, once by us and once at the carrier, so a bug on our side cannot lift the carrier’s limit.

You will find these out in your first ten minutes, so here they are in your first one.

No SOC 2, ISO 27001, HIPAA or independent penetration test

None of these exist and none is in progress. If your process requires one, we will not clear it, and it is cheaper for both of us that you know that now.

No published data processing agreement

We do not have a DPA to hand you. If your review needs one, email Fabio and say so. It is a real gap, and knowing which buyers are actually blocked by it is the only thing that will move it up the list.

No SSO or SAML

Sign-in is a one-time email link or Google. There is no way to connect an identity provider.

No emergency calling

Airlophone cannot reach 911, 999, 112 or their equivalents anywhere, and cannot report a location to a dispatcher. Everyone using it needs a phone that can.

No VAT invoice

A top-up you make yourself produces a numbered invoice you can download, which is a record of the sale. It is not a VAT invoice: that asserts a registration number and a rate, and we hold no VAT registration, so issuing one would be a false tax document. An automatic top-up does not currently produce an invoice at all, which matters if you rely on it and your finance team reconciles from invoices. If either of those blocks you, tell us before you buy.

If you think you have found a security problem, email fabio@echoforge.to and it reaches Fabio Jonathan Arifin directly. There is no bug bounty and no formal disclosure programme, so there is no money in it. What there is instead is a reply the same day and a named person doing the fixing.

Please do not test against other people’s accounts or place calls you have not paid for. Everything on this page can be checked against your own account.