Home
Security

Updated 2026-10-19

The controls that exist today.

Calls, recordings and lead lists deserve care. This page lists the specific protections in the product right now, and what we do not have yet. No badges we have not earned.

Security at DialBreeze

Brayden Milner owns DialBreeze through Brayden Milner LLC. He is our security lead. Security questions and reports go to him.

Here is the short version. Every page and the app use encrypted connections. Only people you let into your workspace can see your leads and calls. Sign-in has limits, lockouts and roles. Dialer actions are written to an activity log. Below is the full list, plus what we do not have yet.

Report a security issue

Found a problem? Email security@dialbreeze.com.

Tell us what you found and the steps to see it.
Please do not look at, change or delete other people's data while you test.
Please give us a fair chance to fix it before you tell anyone else.

A person reads every report and writes back. Our contact file is at /.well-known/security.txt.

Access

Recordings behind sign-in: Call recordings stream only to a signed-in user with an operator or admin role. There is no public recording link.
Roles: Admin and calling roles limit who can manage users, export leads and change workspace settings.
Sign-in lockout: Six failed sign-ins on an account trigger a five-minute block.
Activity log: Dialer actions, like sessions started, calls answered, voicemail drops and saved outcomes, are written to an activity log.
Rate limits: Sign-in, sign-up, token refresh, password reset and inbound carrier webhooks are rate limited per client.

Sessions and tokens

Refresh token rotation: Refresh tokens are stored hashed and rotate on every use. Replaying an old token revokes every session for that user.
Single-use stream tickets: The live dialer event stream uses one-time tickets that expire in about a minute, so no bearer token ever sits in a URL.
Password resets: Reset links are single use and expire.

Webhooks and secrets

Signed carrier webhooks: Every call event from our calling carrier is checked against the carrier's ed25519 signature before it is processed.
Signed outbound webhooks: Disposition events you receive carry an HMAC-SHA256 signature over the timestamp and body.
Encrypted credentials: Carrier credentials stored for a workspace are encrypted at rest with AES-256-GCM.

Transport and browser

HTTPS only: Plain HTTP redirects to HTTPS, with TLS 1.2 as the minimum.
HSTS: dialbreeze.com and app.dialbreeze.com send Strict-Transport-Security, so browsers refuse to downgrade.
Content Security Policy: The app restricts scripts, frames and connections to its own origin and cannot be framed by another site.

Data handling

Breeze and Jetstream: When you hang up, Breeze gives you a transcript you can read. Breeze also gives you a 1-2 sentence summary and one suggested follow-up. Basic excludes AI.
Recordings: Call recording is optional. When it is on, the audio is saved to DialBreeze servers so you can play it back from your account. Our calling carrier may hold a short-lived temporary copy while a recording is processed. Playback requires a signed-in user.
Retention and deletion: No configurable retention period yet. Email support@dialbreeze.com and we delete data on request.

Processors

Calling carrier: calls, numbers and carrier services from our calling carrier, which may use its own sub-processors; and, on Breeze and Jetstream, a speech-to-text service and the language models that write call notes from the transcript.
PayPal: Billing and payments.
Amazon SES: Email delivery.
Cloudflare: Network delivery and protection.
Google: Google Analytics page measurement. It does not load when Global Privacy Control or Do Not Track is on.

Who does what for DNC and calling rules

This is general information, not legal advice.

Who does what for do-not-call and calling rules
Area	What DialBreeze does	What you must do
Do-not-call requests	Keeps an internal DNC list. Choosing Do not call on a call marks the lead and adds the number to the suppression list, and suppressed numbers are left out of every session.	Scrub lists against the National Do Not Call Registry and any state registries that apply before import, and keep your own record of stop requests.
Calling hours	Skips a lead outside your calling hours in the lead's local time, worked out from the US area code. The default calling window is 8am to 9pm in the called number's local time; you set your own hours in settings, and a setting outside the lead's state window shows a warning. Unknown area codes are skipped, not dialed.	Set the calling hours your rules require, including stricter state windows. An area code is not proof of where a person is.
Attempt limits	Caps attempts per lead (up to 15 call attempts per lead, ever; you can set a lower limit) and calls to one number (no more than 3 in any rolling 24 hours, a ceiling you can only lower).	Choose limits that fit your campaign rules. A cap is a ceiling, not a target.
Skip reasons	Records why a lead was not dialed: quiet hours, unknown area code, invalid phone, call cap, do not call, or already engaged.	Review skips and fix the list or policy. Do not re-import a number to get around a skip.
Consent	Does not collect, verify or store proof of consent.	Obtain and document any consent your campaign requires before a number is imported.
List sourcing	Imports the CSV you provide. Does not supply or sell leads.	Source lists lawfully and confirm each list is eligible to call.
Disclosures	Plays only the voicemail drops and disconnect message you upload.	Identify the caller and business, give any required disclosures, and approve every prerecorded message.
Recording	Records calls when you turn recording on in Settings.	Give recording notice and get consent where the law requires it, including in all-party-consent states.

These controls help you run your compliance program. They do not make a campaign compliant on their own, and this table is not legal advice.

Not yet

No SOC 2, ISO 27001 or HIPAA attestation. We will say so here when that changes.
No single sign-on (SAML or OIDC) yet.
No customer-configurable data retention period yet. Deletion is on request by email.

Security questions.

See also the privacy policy and the DNC policy.

Where are recordings stored?

Call recording is optional. When it is on, the audio is saved to DialBreeze servers so you can play it back from your account. Our calling carrier may hold a short-lived temporary copy while a recording is processed. Playback in DialBreeze requires a signed-in user. Retention in your workspace is not configurable yet; email support to have data deleted.

Where does my call audio go?

Call recording is optional. When it is on, the audio is saved to DialBreeze servers so you can play it back from your account. Our calling carrier may hold a short-lived temporary copy while a recording is processed. On Breeze and Jetstream, transcription runs after the call ends, not during it. A speech-to-text service turns the audio into text, and the transcript and AI notes are stored in your account.

Do you have SOC 2?

No. DialBreeze has no third-party security certification today. This page lists the controls that exist in the product, each of which you can ask us about before you buy.

Who can see my leads?

Users in your workspace, according to their role. The privacy policy explains how support access to workspace data is handled.

How do I report a security issue?

Email security@dialbreeze.com. Tell us what you found and how to see it. A person reads every report and writes back.

Who is in charge of security?

Brayden Milner, the owner of DialBreeze (Brayden Milner LLC). He is the security lead.

Ask us to show you.

Ask us about any control on this page before you buy.

Get started Email security questions