Security and compliance at Cypher LM

Your agents hear real customers: their names, numbers, emails and the reasons they call. This article explains how Cypher LM protects that information, what stays in your control, and the steps you can take to keep your own account secure.

How we protect your data

• Your data is separated from other accounts. Every request is checked against the account it belongs to, and we test for cross-account access as part of our security reviews.
• Credentials are encrypted. Tokens for your Google account and your Stripe key are encrypted before they are stored. Our database connections use TLS.
• API keys are stored as hashes. We cannot read a key after creating it, which is why it is shown to you only once.
• Webhooks are signed. Calls coming into Cypher LM from our voice platform are verified, and webhooks we send you carry a signature you can check.
• Links are hard to guess. Payment and booking-management links use long random tokens.
• Google sign-in is protected against request forgery, and connecting a Google service is tied to the account that started it.
• Roles limit access. Teammates see only what their role allows, for example front-desk users never see money. See User roles and permissions.

What you control

• Recordings and transcripts are kept until you delete them. Open a call in Calls and use Delete recording & transcript.
• Caller details are visible only to your account and your teammates.
• Google permissions are granted per service and can be removed with Disconnect in Settings › Integrations.
• Exports of your calls are in Settings › Privacy & data.
• Account deletion is handled by our team within 7 days of your email.

Your data is used only to run your agents and features. Read the full Privacy notice.

Protect your own account

1. Go to Settings › Security.
2. Check the Sign-in card. It shows whether you sign in with Google or with your email.
3. If you sign in with email, select Change password. We email you a code; enter it with a new password. You are then signed out so you can sign in again.
4. Under Where you're signed in, select Sign out everywhere else if a laptop is lost or a login was shared, then confirm Sign out of all devices?.

Good habits for teams

• Give each person their own login through Settings › Team & roles instead of sharing one.
• Use the narrowest role that fits the job.
• Remove people who leave, and revoke their pending invites.
• Keep your Stripe secret key out of email and chat; enter it only in Cypher P › Settings.

Certifications and security reviews

If your organisation needs a security questionnaire, a data processing agreement or details of formal certifications, contact sales@cypherlm.com or use cypherlm.com/contact. We will tell you exactly what we can provide for your review. Single sign-on is covered in SAML single sign-on.