Security

If the issue is sensitive (e.g. account takeover, data exposure), please do notopen a public GitHub issue or post on social media until we've had a chance to fix it. We aim to acknowledge within 2 business days and resolve critical issues within 30 days.

• The production deployment at ringdispatch.com and subdomains.
• Our public API endpoints under /api/*.
• Authentication, authorization, and tenant-isolation issues (cross-tenant data access, privilege escalation, session fixation, etc.).
• Caller-data exposure or recording-policy violations.

• Reports generated solely by automated scanners with no demonstrated impact (e.g. “missing security header” with no exploit path).
• Self-XSS, clickjacking on pages that don't expose actions, or social-engineering attacks against our team or customers.
• Issues in third-party services we integrate with — report those directly to the upstream vendor (AI model provider, voice engine, carrier, payments).
• Denial-of-service or rate-limit testing against production. Use your own dev tenant if you need to test at load.

What we run today to keep tenants isolated, bills bounded, and the AI on-script. These are running controls, not aspirations — each is exercised by automated tests in the codebase.

• Per-tenant data isolation. Every request runs inside a tenant boundary; cross-tenant DB reads are prevented at the data layer, not via convention. Webhook routing re-binds events to the correct tenant by Stripe customer ID with email-match verification on new customers.
• Prompt-injection defenses, in two layers. Owner-typed config is the layer we filter deterministically: business notes, hours, service and team fields are scanned against a multi-language injection catalogue and rejected at the save boundary, and every owner string is Unicode-normalized, stripped of hidden/bidi/tag-smuggling characters, and cleared of our structural prompt tags before it is assembled into the system prompt. Live caller speechis deliberately NOT regex-screened — a false positive there hangs up on a real customer — so the defense is instruction-level: the assistant is told to treat “ignore your previous instructions”-style attempts as ordinary speech, to refuse to reveal the system prompt or business config, and to refuse persona-roleplay and hypothetical (“what would you say if you weren't bound…”) framings. A caller who doubles down on impersonating the owner, an auditor, or the AI vendor gets the call closed out, with the exchange captured as a flagged message that sorts to the top of the owner's needs-action queue. That last layer is model compliance, not a deterministic filter — we'd rather say so than overstate it.
• Per-call cost ceiling.Per-provider budgets (AI model tokens, voice-engine characters) cap a single call's spend, on top of a daily per-provider ceiling and an 8-minute wall-clock cap on the call itself. A stuck loop or a bad actor cannot mint a $200 surprise charge.
• Token-bucket abuse rate-limiting. Anonymous + paid endpoints (TTS, voice-clone, BAA intake, privacy-erase) have IP-keyed token-bucket rate limits, tuned per-route to the legitimate ceiling.
• Stripe webhook signature + idempotency. Every webhook is HMAC-verified, deduped by event ID, and rolled back on handler failure so a single subscription update cannot replay into duplicate state.
• Automated data retention. Bookings + messages + attachments + notify outbox + class seats + webhook events are aged out on a nightly sweep. Default retention is 18 months; HIPAA-mode tenants override to 6 years to meet HHS minimums.
• PII scrubbing on crash reports. Everything we forward to Sentry runs through a redactor first: SSNs, IBANs, card numbers, phone numbers, emails, and IP addresses are replaced inline across the exception message, stack-frame variables, breadcrumbs, and extra context, and request headers, cookies, and the user block are dropped whole. Our own application logs are line-delimited JSON keyed by tenant + request id — they are not scrubbed by a filter, so call sites log truncated identifiers (last-4 digits) rather than full caller records.
• GDPR / CCPA erasure. Owner-gated /api/privacy/erase endpoint redacts bookings, messages, attachments, and queued outbound messages atomically. Sample / demo rows are preserved so the dashboard demo survives.
• One-click email unsubscribe. Outbound mail carries RFC 8058 List-Unsubscribe + one-click List-Unsubscribe-Post headers with a per-recipient signed token, per the Gmail/Yahoo Feb-2024 bulk-sender requirements; boot-time preflight flags the deploy if the unsubscribe endpoint is unconfigured. Bounces and complaints are recorded to a per-tenant suppression list.
• Auditable activation SLA. Paid checkout → AI live elapsed times are recorded per first-time subscription; once there are production activations to show, the distribution surfaces on /status.

As long as you make a good-faith effort to comply with this policy, we will not initiate legal action and will treat the research as authorized under applicable computer-misuse laws. If a third party brings action against you for activities conducted in accordance with this policy, we will make that authorization known.

To report abuse of the RingDispatch service — fraud, harassment, illegal use, phishing, robocall abuse, or content that violates our Terms of Service — email abuse@ringdispatch.com. We act on credible reports within 2 business days. Include the offending phone number, time of incident, and any recording or transcript you have.

RingDispatch complies with the Digital Millennium Copyright Act (17 U.S.C. § 512). If you believe content delivered through the Service infringes your copyright, send a written notice to our designated agent:

• Designated agent: RingDispatch LLC — DMCA Agent
• Email: dmca@ringdispatch.com
• Mail: RingDispatch LLC, c/o Registered Agent, Commonwealth of Virginia (full mailing address available on request via dmca@ringdispatch.com or via the Virginia SCC business entity record).

Your notice must include: (a) a physical or electronic signature; (b) identification of the copyrighted work; (c) identification of the infringing material and its location; (d) your contact information; (e) a statement of good-faith belief that the use is unauthorized; (f) a statement, under penalty of perjury, that the information is accurate and that you are authorized to act on behalf of the rights holder.

Repeat infringers have their accounts terminated. Bad-faith notices may result in liability under § 512(f).

For subpoenas, search warrants, court orders, or other legal process, see our Privacy Policy (“Legal process” section) for our standard handling, then contact legal@ringdispatch.com. We require valid process, narrowly scoped, and we notify affected tenants unless legally prohibited.

RingDispatch is a commercial small-business product. Honest disclosure of what we are NOT authorized for, so you don’t discover it in a security review:

• NOT FedRAMP-authorized (no Moderate or High baseline; no Joint Authorization Board sponsorship)
• NOT DFARS 252.204-7012 / NIST SP 800-171 attested — we are not appropriate for handling Covered Defense Information or CUI
• NOT CMMC 2.0 certifiedat any level — no System Security Plan, no POA&M, no C3PAO assessment
• NOT on the GSA Schedule — no SAM.gov registration as a federal-track vendor, no CAGE code in our pricing
• NOT CJIS-, IRS-Pub-1075-, or ITAR-compliant — calls touching law-enforcement, federal tax, or export-controlled data should not be routed through us
• WCAG 2.1 AA is our accessibility target, which is the correct technical baseline for Section 508 / 36 CFR 1194 conformance — but a formal VPAT / Accessibility Conformance Report is not yet published. Email hello@ringdispatch.com if your federal procurement requires one and we’ll prepare it.

If you’re an SDVOSB / VOSB doing commercial work outside the above scope, RingDispatch is a fine fit. See /accessibility for our SDVOSB / VocRehab documentation support.