Security & data

Where your data actually lives.

Call recordings are sensitive, so here is exactly where everything lives and who touches it — the plain-English version of our Data Processing Agreement. The DPA itself is authoritative.

Recordings live in your 3CX

Your call audio is stored in one place: your own 3CX system. Recordings are never stored in Salesforce, and CallCore keeps no library of them. When someone presses play on a record page, the CallCore package in your org mints a short-lived signed URL — using a shared secret unique to your org — and the player fetches the audio through CallCore, which verifies the signature and proxies the bytes straight from your 3CX.

The one exception is transient and deliberate: to transcribe a large recording, the pipeline may briefly copy it, compress it, and stage it for your Azure OpenAI deployment. Every working copy is deleted as soon as the pipeline is done with it, and a monitored nightly job sweeps up anything left behind within two days — if that job ever fails to check in, our alerting fires. The exact mechanics are set out in the DPA.

Transcripts & summaries

Transcripts and AI summaries are written into your Salesforce org, where your existing Salesforce permissions — plus CallCore's granular permission levels — control who sees what. Transcription and summarisation run on your own Azure OpenAI deployment, in your own Azure tenancy: your audio is processed by AI resources you control, and Microsoft bills that usage to you directly.

Hosting & isolation

The CallCore platform runs on Microsoft Azure in the UK West region. Each customer workspace has its own isolated database — call metadata, transcripts and configuration are never pooled across tenants. Sign-in is via your Microsoft (Entra) account; CallCore never sees a password.

Who else touches your data

A deliberately short list of sub-processors:

  • Microsoft Azure — hosting and storage (UK West)
  • Twilio SendGrid — transactional email
  • Sentry — error monitoring (technical diagnostics, not call content)
  • Paddle — payments, as merchant of record (never sees call data)

The complete, current list with roles and locations is in the DPA schedules.

When you leave

Cancel any time — no notice period. When a subscription (or trial) ends, ingestion, transcription and sync stop. Your workspace database is retained for a grace period, then deleted; on request we provide an export of your data before deletion. Everything already synced to your Salesforce stays yours, in your org — and your recordings were in your 3CX all along.

The paperwork