Automation you can stand behind
Automated calls and messages carry real risk: to your customers, your reputation and your budget. These are the safeguards built into TuniCall.
Credentials and accounts
Provider keys unlock your phone numbers and AI accounts, so they are treated as the most sensitive data in the system.
- AES-256-GCM encryption for provider credentials stored on the server.
- Write-only secrets: once saved, a key is never sent back to the browser.
- Passwords hashed with scrypt and a unique salt.
- HTTPS only in production, with HTTP Strict Transport Security.
Sign-in and sessions
Only the people you invite can reach the workspace, with the access their role needs.
- Bot protection on sign-in with Cloudflare Turnstile, plus rate limiting.
- Session cookies that are HTTP-only, secure and same-site strict, expiring after 12 hours.
- Administrator and agent roles; deactivating a user ends their sessions immediately.
- Changing a password signs out every other session.
Webhooks and live audio
Incoming events and audio are only accepted when they provably come from your providers.
- Twilio request signatures verified on every webhook.
- Meta X-Hub-Signature-256 verified for the WhatsApp Cloud API.
- Media sessions require the provider signature and a one-time token valid for 60 seconds.
- Call duration limits and tool calls deduplicated per provider identifier.
Consent, limits and no double sends
Campaign tooling is where automation can go wrong at scale, so it has the strictest rules.
- Consent per channel and purpose, with its source, checked before anyone is contacted.
- Do-not-contact respected by campaigns and manual calls; agents cannot override an opt-out.
- Business hours and active weekdays in the campaign time zone.
- Daily budgets per campaign and for the workspace, plus an emergency stop.
- Uncertain sends are marked unknown instead of being retried, to avoid contacting someone twice.
Audit trail and deployment choices
Know who changed what, and decide where your data is processed.
- Audit log of sign-ins, user and password changes, agent, campaign, knowledge, routing and consent changes, messages sent, calls placed, takeovers and contact edits.
- Routing changes are previewed and keep a snapshot of the previous configuration.
- Self-hosting on your own servers, with Qwen models when processing must stay in-house.
Found a vulnerability?
Please tell us privately through the contact form before disclosing it publicly. Include the steps to reproduce, and we will get back to you.
Questions from your security team?
We are happy to walk through the architecture, data flows and deployment options with them.