Security
Security principles
BCG Engineering applies reasonable safeguards based on the nature of the service, the data processed, and the risks identified. Security is shared: BCG protects the service it operates; customers protect their accounts, integrations, users, content, calling decisions, and credentials.
Access control
- Access is limited to people and systems that need it for operation, support, or security.
- Administrative access is controlled and reviewed as appropriate.
- Customers should use unique accounts, least privilege, strong authentication, and prompt offboarding.
- API keys, webhooks, phone numbers, and provider credentials must be stored and rotated securely.
Data protection
- Transport encryption is used where supported by the service and provider.
- Customer data is separated by account or workspace controls appropriate to the product.
- Call recordings, transcripts, and sensitive content should be disabled or minimized unless needed.
- Retention and deletion should be configured to the shortest practical period.
Application and infrastructure
We maintain dependency updates, change controls, logging, monitoring, backup practices, and protective measures appropriate to the environment. Third-party hosting, telephony, AI, and storage providers have their own security controls and terms; customers should review them for their use case.
Voice and AI safety
Customers must authorize campaigns, protect contact data, validate caller ID, configure opt-outs, disclose AI use where required, obtain recording consent, review agent behavior, and provide human escalation. We may rate-limit, block, or suspend traffic that creates abuse, fraud, privacy, safety, or provider risk.
Incident response
We investigate suspected security incidents, take containment measures, preserve relevant evidence, and provide notifications when required by law or contract. Customers must notify us promptly if they suspect compromise of an account, integration, API key, phone number, or customer data.
Vulnerability disclosure
Send a responsible report to security@bcg-engineering.com with steps to reproduce, affected URL or component, impact, and a safe contact method. Do not access data that is not yours, disrupt service, exfiltrate secrets, or test against other customers. Reports should allow a reasonable period for investigation and remediation.
Availability and limitations
Security controls cannot eliminate every risk, and availability may depend on third-party providers, networks, configuration, and customer actions. BCG does not promise that the service is invulnerable or uninterrupted.
Security contact
security@bcg-engineering.com · legal and privacy requests: contact@bcg-engineering.com
Last updated: September 4, 2026.