Security

This page describes the controls you can use and what Dialgem does by default. It does not replace your own review; use it as the starting point for one.

Who can get in

• Roles. Every member is an owner, admin or member. Only owners can grant or change the owner role, and an organization always keeps at least one owner. See Create an account.
• Two-step verification. People can confirm sign-in with an authenticator app, a passkey, or a code sent by email or text, and keep recovery codes. An owner can require a strong factor of everyone. See Two-step verification.
• Single sign-on. Teams can sign in through their identity provider. See Single sign-on.
• Sensitive changes ask again. Creating or revoking an API key and changing a member's role ask for a fresh second step when it is on.

How API access is limited

• Keys are shown in full once, and Dialgem stores only a hash of them. A lost key cannot be recovered, only replaced.
• A key can be limited to the scopes it needs, to a list of IP addresses, and to an expiry of up to three years. See API key scopes.
• Browsers never receive an API key. Web calls use a one-use token that lasts 60 seconds.
• Webhooks are signed, so your server can check that a request really came from Dialgem and was not replayed.
• All public endpoints are served over HTTPS.

What gets recorded

An append-only audit log records who changed what in your organization, such as keys, members and settings. Entries cannot be edited or removed by members.

Your data

• Per-agent privacy settings. Each agent can redact personal data from stored transcripts (pii_redaction_enabled), and can turn off recording (opt_out_call_recording) or transcript storage (opt_out_transcript_storage). These are off by default, so choose them deliberately for agents that handle sensitive calls. See Prompt agents.
• Retention. Set how long call content, contacts and imports are kept, with an organization default and a per-agent override. Delete one person's data on request. See Data retention and erasure.
• Recordings are optional per agent and are fetched through short-lived links.
• Card details are handled by Stripe. Dialgem never sees or stores your card number.

Providers in the call path

A call passes through speech, language-model and telephony providers that you choose when you configure an agent. Retention and training terms at those providers are theirs, and Dialgem's retention settings do not reach them. Check the terms of each provider you enable before you make promises to your own customers.

Certifications

Dialgem does not currently hold a SOC 2 report, an ISO 27001 certificate or a HIPAA attestation, and does not sign Business Associate Agreements. If you need one of these, contact us before you build on Dialgem.