Security
Security and data practices
How we handle payments, account access, call data and recordings. Each section states the practice and the mechanism behind it.
Card details never reach us
Payment runs on a page Stripe hosts. Card numbers are entered there and never touch our servers, so there is no card data here to breach.
There are no passwords
Sign in is a one-time link to your email, or Google. The product has no password to store, so there is nothing here to phish, reuse or dump.
Recordings expire after 90 days
Nothing is recorded unless an admin switches it on. On Professional a recording is kept for 90 days so you can play or download it, then deleted. You can delete one sooner, and an admin can turn audio retention off.
Access is enforced at the database
Row-level security bounds every query before it runs, so a query that should return nothing returns nothing even when the code asking is wrong. The key that ships to your browser can write one table out of twenty-three.
Dialled numbers are not sent to analytics
Not to analytics, not to error reporting, hashed or otherwise. Click capture and session replay are off in code rather than in a vendor dashboard somebody can switch back on.
Prepaid credit limits your exposure
Credit is prepaid, so the most an account can lose is what is on it. Spend caps are checked when a member presses Call and enforced again at the carrier, and the ledger is append-only: entries can be added and never rewritten, including by us.
Where it lives
Postgres, managed by Supabase, in AWS us-west-2 (Oregon, United States). The application runs on Railway with Cloudflare in front of it, and backups stay inside that Supabase project. The service was created by Fabio Jonathan in San Francisco. If data residency decides your review, that is the fact to take into it, and it is on the privacy policy too.
Who else touches it
The full list. A vendor is here because the product cannot work without it, and each line says what it actually receives.
- Supabasedatabase and sign-in
- Everything the product stores: your email address, your calls, your ledger, your contacts. Hosted on AWS in us-west-2 (Oregon, United States).
- Railwayapplication hosting
- Runs the application itself. Data in transit through it, nothing stored there.
- CloudflareDNS and edge
- Sits in front of the domain, so it sees request metadata including your IP address and the page you asked for. It does not see call audio.
- Stripepayments
- Your card details, entered on a page Stripe hosts, plus your email and any tax ID you choose to give.
- Telnyxcarrier
- The number you dialled, for calls it carries. It is a licensed carrier and needs the number to connect the call. Also carries rented numbers and their incoming texts.
- Twiliocarrier
- The number you dialled, for the minority of destinations it carries rather than Telnyx.
- Vonagecarrier
- The number you dialled, for the minority of destinations it carries rather than Telnyx.
- Brevoemail delivery
- Your email address and the message itself, for sign-in links and team invitations.
- PostHogproduct analytics
- The destination country and price band of a call, never the number. Automatic click capture and session replay are switched off in code.
- Sentryerror reporting
- Crash reports, with anything phone-shaped redacted before the report leaves your browser or our server.
- Ahrefsweb analytics
- Page views on public marketing pages only. It is not loaded on the dialer, your history, your contacts or your account.
- DeepInfratranscription
- Nothing, unless your account has turned call recording on. Where it has, the recorded audio, to turn it into text. It does not write the summary.
- OpenRoutersummaries and note write-ups
- Nothing, unless your account has turned call recording on. Where it has, the transcript text and the note you typed, never the audio, sent to Google's Gemini model to write the summary and the completed note.
- Telegramoptional alerts
- Nothing, unless you deliberately link a chat. Where you have, the alerts you asked for.
Where we are not yet
No SOC 2, ISO 27001, HIPAA or independent penetration test, and none in progress. No data processing agreement to hand you yet. No SSO or SAML, because sign-in is an email link or Google. No VAT invoice, because we hold no VAT registration and issuing one would be a false tax document.
If any of those decide your review, email Fabio before you buy and you will get a straight answer the same day. Knowing which of them actually blocks a real buyer is the only thing that moves one up the list.
Found a problem
Email fabio@airlophone.com and it reaches Fabio Jonathan directly. There is no bug bounty, so there is no money in it. What there is instead is a reply the same day and a named person doing the fixing. Please do not test against other people’s accounts or place calls you have not paid for.
Check it on a real account
Set a cap on a colleague, place a call, and download the invoice. That answers more of a security review than a document does, and it costs nothing to try.