Security

If the issue is sensitive (e.g. account takeover, data exposure), please do notopen a public GitHub issue or post on social media until we've had a chance to fix it. We aim to acknowledge within 2 business days and resolve critical issues within 30 days.

• The production deployment at ringdispatch.com and subdomains.
• Our public API endpoints under /api/*.
• Authentication, authorization, and tenant-isolation issues (cross-tenant data access, privilege escalation, session fixation, etc.).
• Caller-data exposure or recording-policy violations.

• Reports generated solely by automated scanners with no demonstrated impact (e.g. “missing security header” with no exploit path).
• Self-XSS, clickjacking on pages that don't expose actions, or social-engineering attacks against our team or customers.
• Issues in third-party services we integrate with — report those directly to the upstream vendor (AI model provider, voice engine, carrier, payments).
• Denial-of-service or rate-limit testing against production. Use your own dev tenant if you need to test at load.

What we run today to keep tenants isolated, bills bounded, and the AI on-script. These are running controls, not aspirations — each is exercised by automated tests in the codebase.

• Per-tenant data isolation. Every request runs inside a tenant boundary; cross-tenant DB reads are prevented at the data layer, not via convention. Webhook routing re-binds events to the correct tenant by Stripe customer ID with email-match verification on new customers.
• Prompt-injection + jailbreak defenses. Every caller utterance is screened before it reaches the AI. Calls that attempt to override the system prompt, exfiltrate the business config, or impersonate the operator are detected and refused with a safe response.
• Per-call cost ceiling.Per-provider budgets (AI model tokens, voice-engine characters, transcription minutes) cap a single call's spend. A stuck loop or a bad actor cannot mint a $200 surprise charge.
• Token-bucket abuse rate-limiting. Anonymous + paid endpoints (TTS, voice-clone, BAA intake, privacy-erase) have IP-keyed token-bucket rate limits, tuned per-route to the legitimate ceiling.
• Stripe webhook signature + idempotency. Every webhook is HMAC-verified, deduped by event ID, and rolled back on handler failure so a single subscription update cannot replay into duplicate state.
• Automated data retention. Bookings + messages + attachments + notify outbox + class seats + webhook events are aged out on a nightly sweep. Default retention is 18 months; HIPAA-mode tenants override to 6 years to meet HHS minimums.
• PII redaction in logs. Caller phones, emails, card numbers, SSNs, and bearer tokens are stripped before any log line reaches stdout or Sentry. Owner emails are tenant-tagged for routing but never logged in full.
• GDPR / CCPA erasure. Owner-gated /api/privacy/erase endpoint redacts bookings, messages, attachments, and queued outbound messages atomically. Sample / demo rows are preserved so the dashboard demo survives.
• One-click email unsubscribe. Every commercial send carries RFC 8058 List-Unsubscribe headers per the Gmail/Yahoo Feb-2024 bulk-sender requirements; bounces and complaints are recorded to a per-tenant suppression list.
• Auditable activation SLA. Paid checkout → AI live elapsed times are recorded per first-time subscription; the distribution surfaces on /status.

As long as you make a good-faith effort to comply with this policy, we will not initiate legal action and will treat the research as authorized under applicable computer-misuse laws. If a third party brings action against you for activities conducted in accordance with this policy, we will make that authorization known.

To report abuse of the RingDispatch service — fraud, harassment, illegal use, phishing, robocall abuse, or content that violates our Terms of Service — email abuse@ringdispatch.com. We act on credible reports within 2 business days. Include the offending phone number, time of incident, and any recording or transcript you have.

RingDispatch complies with the Digital Millennium Copyright Act (17 U.S.C. § 512). If you believe content delivered through the Service infringes your copyright, send a written notice to our designated agent:

• Designated agent: RingDispatch LLC — DMCA Agent
• Email: dmca@ringdispatch.com
• Mail: RingDispatch LLC, c/o Registered Agent, Commonwealth of Virginia (full mailing address available on request via dmca@ringdispatch.com or via the Virginia SCC business entity record).

Your notice must include: (a) a physical or electronic signature; (b) identification of the copyrighted work; (c) identification of the infringing material and its location; (d) your contact information; (e) a statement of good-faith belief that the use is unauthorized; (f) a statement, under penalty of perjury, that the information is accurate and that you are authorized to act on behalf of the rights holder.

Repeat infringers have their accounts terminated. Bad-faith notices may result in liability under § 512(f).

For subpoenas, search warrants, court orders, or other legal process, see our Privacy Policy (“Legal process” section) for our standard handling, then contact legal@ringdispatch.com. We require valid process, narrowly scoped, and we notify affected tenants unless legally prohibited.

RingDispatch is a commercial small-business product. Honest disclosure of what we are NOT authorized for, so you don’t discover it in a security review:

• NOT FedRAMP-authorized (no Moderate or High baseline; no Joint Authorization Board sponsorship)
• NOT DFARS 252.204-7012 / NIST SP 800-171 attested — we are not appropriate for handling Covered Defense Information or CUI
• NOT CMMC 2.0 certifiedat any level — no System Security Plan, no POA&M, no C3PAO assessment
• NOT on the GSA Schedule — no SAM.gov registration as a federal-track vendor, no CAGE code in our pricing
• NOT CJIS-, IRS-Pub-1075-, or ITAR-compliant — calls touching law-enforcement, federal tax, or export-controlled data should not be routed through us
• WCAG 2.1 AA is our accessibility target, which is the correct technical baseline for Section 508 / 36 CFR 1194 conformance — but a formal VPAT / Accessibility Conformance Report is not yet published. Email hello@ringdispatch.com if your federal procurement requires one and we’ll prepare it.

If you’re an SDVOSB / VOSB doing commercial work outside the above scope, RingDispatch is a fine fit. See /accessibility for our SDVOSB / VocRehab documentation support.