Last updated: July 2026
The application and database run on Fly.io in the EU (Paris). The AI voice agent service runs in Fly.io’s Singapore region, because media for Indian calls is anchored closer to the carrier. The database publishes no public service and is reachable only over Fly.io’s private network.
Passwords are hashed with Argon2 and must be at least 12 characters with mixed case, a digit and a symbol. Email addresses are verified by a one-time code before an account can place calls or spend from its balance. Session tokens are AES-256 encrypted cookies (iron-session). API keys are SHA-256 hashed at rest — the plaintext is only returned once at creation, and a key may be restricted to an IP allowlist.
Sign-in, registration, password reset and one-time-code entry are rate limited per source address and per account. A one-time code is six digits, generated from a cryptographic random source, expires after 15 minutes, and is invalidated after five incorrect attempts.
Each organization’s calls, recordings, transcripts and analyses live in a dedicated SurrealDB namespace with its own database credential, derived per tenant from a secret held only by the application server. Authentication middleware resolves the namespace from the session or API key on every request, so a request cannot address a namespace it does not own.
Authentication events, configuration changes and actions that spend from a balance are recorded with the acting user or API key, source address, outcome and timestamp. An organization’s owner can read their own audit log through the API.
We would rather tell you than let you assume. We hold no third-party security certification: no SOC 2, no ISO 27001, and no independent penetration test has been completed. Single sign-on (SAML/OIDC) and SCIM provisioning are not available. If your procurement process requires any of these, please talk to us about timelines before you buy rather than after.
Please report security vulnerabilities to security@wayso.in. We aim to acknowledge reports within 48 hours.