DialLink Security Overview

Version 2.0 · Last updated November 2, 2026 · Previous versions: Legal Archive

This page describes how DialLink Corp. protects customer data in its cloud phone system, messaging and AI products. It is provided for information; our binding security commitments are set out in Annex II of our Data Processing Addendum, which controls. This page replaces the former "Security" and "Data Hosting" pages. Every statement on this page describes what we do today; where a control is planned rather than in place, we say so. Security questionnaires and vulnerability reports: trust@diallink.com.

1. Infrastructure and hosting

The Services run on Amazon Web Services (AWS) in the United States (primary region: US East, N. Virginia). Customer Data is stored in the United States.
AWS data centers maintain physical security, environmental controls and independent certifications (including SOC 1/2/3, ISO 27001 and PCI DSS) for the infrastructure layer.
Production environments are separated from development and test environments. Production data is not copied to development or test environments.
Voice and messaging connectivity is provided through our carrier partner, Twilio, whose security practices are described on its trust site.

2. Data encryption

In transit: TLS 1.2 or higher for all connections between the web, desktop and mobile applications, the APIs, our websites and our platform.
At rest: databases, stored recordings, voicemails, transcripts, messages, contacts, AI Agent data and database backups are encrypted with AES-256 server-side encryption managed by AWS.
Application secrets and credentials are managed in a dedicated secrets manager rather than in source code.

3. Access control

Access to production systems is restricted to named engineers and support staff on a need-to-know basis, through individual credentials and role-based access; direct infrastructure access is possible only through a private network connection.
DialLink personnel do not access the content of customer calls, messages or transcripts except when a customer asks us to in a support request, when we investigate suspected abuse or a security incident, or when the law requires.
Engineering and support contractors work under written agreements with confidentiality and data protection obligations and under the same access controls.
Access is revoked promptly when a person's role changes or they leave.

4. Customer-side controls

Three roles — Owner, Administrator and User — with control over who can access call recordings, transcripts and call records.
Sign-in with Google, Microsoft or Apple accounts, and a verification code sent by text message when a User signs in from a new location.
Recording settings, the ability to pause or stop recording during a call, and deletion of recordings, voicemails, transcripts, messages and contacts through the apps and the API.

5. Application and network security

Code review before deployment, and automated scanning of code, dependencies and infrastructure for vulnerabilities (static analysis, dependency alerts and AWS Inspector); findings are remediated according to severity.
Production networks are segmented and protected by firewalls and security groups; administrative access is through secured channels only.
Protection against abuse of the platform, including limits on concurrent calls, international-destination controls, caller ID restricted to the customer's own numbers, automated alerts on unusual charges, and STIR/SHAKEN call attestation through our carrier partner.

6. Monitoring, logging and incident response

Infrastructure and application logs are collected centrally and retained for periods between 7 days and 12 months depending on the type of log; automated alerts on errors and unusual activity are sent to the engineering team and investigated.
We maintain an incident response plan covering detection, severity classification, containment, escalation and post-incident review. We notify affected customers of a personal data breach without undue delay and within 72 hours of confirming it, as the Data Processing Addendum provides (subject to any delay that law or law enforcement requires), and we follow the FCC's breach notification rules for customer proprietary network information.
Product analytics and session replay (PostHog) run only on the sign-in, sign-up and payment-setup pages, not inside the signed-in apps. Text typed into input fields is masked on the device before anything is sent, passwords are never captured, card fields are never visible, replays are retained for 90 days and are accessible only to a small number of named staff (Privacy Policy, Section 8).
Service availability is published at status.diallink.com.

7. Backups, resilience and retention

Databases are backed up automatically every day, with point-in-time recovery for 30 days, to encrypted storage within the same region. Recordings and voicemails are kept in durable object storage that AWS replicates across multiple availability zones.
The platform is deployed across multiple availability zones with redundant components, and a disaster recovery plan is maintained.
Customer Data is kept for the life of the account unless the customer deletes it or asks us to. After termination it is retained so that the customer can reactivate the account or obtain a copy, and is deleted from production systems within 30 days after the customer asks us in writing, or immediately when the customer deletes the account; backup copies expire within 30 days after deletion (Terms of Service, Section 10.6).

8. AI Features

AI Features use third-party speech and language models (currently OpenAI, xAI, Anthropic and ElevenLabs) listed on our Sub-processors page, used under terms that exclude training on customer data, with retention at the provider of no more than 30 days.
We do not use customer call content, transcripts or messages to train AI models.
Customers control which AI Features are enabled and what their AI Agents may access through integrations; the actions an AI Agent takes in connected tools are logged in the call record for 90 days.

9. Vendor management

Sub-processors are engaged under written terms that include data protection obligations, listed on our Sub-processors page with their function, location and retention, and changes are notified to customers in advance as described in the Data Processing Addendum.

10. Compliance

Data protection: Our Data Processing Addendum incorporates the EU Standard Contractual Clauses (2021), the UK International Data Transfer Addendum and U.S. state service-provider terms.
Telecommunications: DialLink Corp. is registered with the Federal Communications Commission (FCC) as an interconnected VoIP provider. Our 911, CPNI and robocall-mitigation practices are described in our 911 Service Terms, our Privacy Policy and this page.
SOC 2: We do not currently hold a SOC 2 report. We answer security questionnaires on request at trust@diallink.com.
HIPAA: We do not currently offer a Business Associate Agreement; customers must not use the Services to create, receive, store or transmit protected health information.
PCI DSS: We do not store payment card data; payments are processed by our PCI DSS-compliant payment processor. The Services are not designed for collecting payment card data in calls or messages; Users can pause recording when a caller reads out card details.

11. Responsible disclosure

If you believe you have found a security vulnerability in the Services, email trust@diallink.com with details. We ask that you give us a reasonable time to investigate and fix the issue before disclosing it, that you do not access or modify other customers' data, and that you do not disrupt the Services. We will acknowledge your report and keep you informed.

12. Contact

trust@diallink.com · DialLink Corp., 1688 Meridian Ave, Suite 700, Miami Beach, FL 33139, United States.