Security and trust

Last updated: 5 September 2026

Vortore answers the phone for businesses, which means it hears what their customers say. This page says plainly what we do to protect that, and what we have not yet done. Every item in the first list is enforced in the product, not in a policy document.

What is in place

• One business cannot see another’s data. Every query a business user can reach is written with that business’s identity in it. There is no screen, export or report available to a business that spans more than one.
• A consent record on every answered call. Each call writes a row to a consent ledger saying what the caller was told and when.
• Transcripts, not recordings. Audio is processed live to produce a transcript. We do not store the audio.
• Retention you control. Transcripts and message bodies are redacted after a window each business sets. The default is 365 days; a business may choose shorter, or choose to keep everything.
• Erasure that shows its work. A person may ask to be forgotten. The request produces an itemised receipt of what was removed and what was deliberately kept, such as an appointment that has not happened yet, so the answer is checkable rather than assumed.
• Data export. Everything held about a phone number can be exported on request.
• Messages only from approved templates. SMS to customers uses pre-registered DLT templates only. The product refuses to improvise a text, because a single unapproved message can get a sender blacklisted for every business at once.
• No bought lists, no strangers. Outbound calls go only to a business’s own customers: reminders, confirmations, ring-backs to people who rang and could not get through, and recall calls to people who have visited before. Every outbound call passes one gate that refuses anything not permitted for that business, and the 9 AM to 8 PM window is enforced there.
• Phone numbers cut to four digits in our own logs. Our structured logs never carry a full number.
• An audit trail of team actions. Changes made by a business’s team are recorded with who did what and when.
• Public endpoints are rate-limited and size-capped. Sign-up, demo and login routes refuse floods.
• Uptime is measured and published. A separate process probes the service on a schedule and the status page shows what it found, including how often it checked and how much of the month it actually observed.
• Payments never touch us. Card and UPI details go to Razorpay. We hold a reference, not the instrument.
• Hosted in Mumbai. The database and the services run in Google Cloud’s asia-south1 region. Secrets live in Secret Manager, not in code.
• Vendors receive only their step. Plivo carries the call, LiveKit handles the live audio, Deepgram turns speech into text, Google’s Gemini decides what to say, Sarvam turns the reply into speech, and Razorpay takes payments. Each receives what its step needs and nothing else.

What is not yet in place

• No ISO 27001 certification. We follow the controls that matter for a product this size; we have not paid for the certificate. We will when a customer’s procurement needs it.
• No third-party penetration test yet. A CERT-In empanelled assessment is planned, not done.
• No published contract terms with each vendor. The vendors are named above; the data-processing paperwork behind each is not yet published.
• No end-to-end phone check on the status page yet. It shows whether the service and its database answer, not yet whether a call to a live number is picked up.

Reporting a problem

If you believe you have found a security issue, write to support@vortore.comwith the subject line “Security”. We reply within two working days and will not take action against anyone reporting in good faith.