Security

2.Encryption

• In transit: TLS 1.2 or higher.
• At rest: AES-256, in our database provider, Supabase.

3.Workspace isolation and access

• Every business’s data is separated by row-level security in the database, workspace by workspace.
• Access inside a workspace depends on the user’s role (owners, administrators and staff).
• JULY Call staff open a business’s contacts, conversations, calls, transcripts or recordings only to provide support, to keep the Service secure or when the law requires it: the view is read-only, and every such access is recorded, with its reason, in an audit log that cannot be edited.

4.Sign-in

Sign-in is handled by Supabase Auth, with an email address and password or with Google (OAuth 2.0).

5.Verified connections

• Webhooks from Twilio, our telephony provider, are verified by their signatures (HMAC) before they are acted on.
• The voice relay that handles live calls is authenticated with a secret before it can exchange data with the app.

6.Payments

Card payments are processed by Helcim, a PCI DSS Level 1 payment processor. Card numbers are entered in Helcim’s secure form and never touch our servers; card data is held only by Helcim.

7.Where data lives

Our records are stored in Canada, and our database provider keeps daily backups for 7 days. Calls, texts and email are processed in the United States, and some providers keep their own copies for a limited time. Our Privacy Policy has the full table, and our Subprocessors list names each provider and what it keeps.

8.Certifications

JULY Call itself does not yet hold a SOC 2 report or an ISO 27001 certification; an independent SOC 2 audit of JULY Call is on our roadmap. These are our providers’ own attestations, as each provider publishes them:

• Supabase (database, sign-in and recordings) and Vercel (web app): SOC 2 Type II.
• Twilio (calls, texts and live speech) and Anthropic (AI): SOC 2 Type II and ISO 27001.
• Amazon Web Services, which hosts our database in Canada and sends our email through Amazon SES: SOC 2 and ISO 27001.
• Helcim (card payments): PCI DSS Level 1.
• Railway (the voice relay) and JULY Send (our email platform, a JULY group service): no attestation is claimed here.

9.Health information

We do not offer a HIPAA business associate agreement (BAA). Health-care customers must not use JULY Call for anything that needs one, and the receptionist never discusses diagnoses or test results.

10.Your part

• Use strong, unique passwords and never share logins.
• Give each person the lowest role they need, and remove access as soon as someone leaves.
• Protect anything you export or download, such as call logs and recordings.
• Tell us at once if you notice anything suspicious in your account.

11.If something goes wrong

We investigate suspected security incidents, take steps to contain them, and notify affected customers, individuals and regulators as the law and our Data Processing Addendum require.

12.Report a vulnerability

If you believe you have found a security vulnerability in JULY Call, email support@july.ca with “Security” in the subject line, a description of the issue, the steps to reproduce it and any proof of concept.

While you research, please:

• do not access, change or delete data that is not yours, and stop as soon as you reach anyone else’s data;
• do not run denial-of-service, load or spam tests, and do not use social engineering or physical attacks;
• do not place calls or send messages to numbers that are not yours; and
• give us reasonable time to fix the issue before you disclose it.

We will acknowledge your report and keep you informed. We will not take legal action against researchers who act in good faith and follow these rules. We do not currently offer a paid bug bounty.