Security and data handling

ClawCall places calls, processes call audio, and stores account data using the following sub-processors:

• Telnyx — phone numbers, outbound and inbound calling, call control, and call recording.
• Meta — speech-to-text during phone calls, including transcription after you join a call.
• Anthropic — the language model that runs the voice agent during calls, safety screening of call requests, the SMS agent, the dashboard chat assistant, and reading images you send by text message.
• ElevenLabs — text-to-speech for the voice agent.
• OpenAI — optional transcription of voice notes you send by text message, when enabled.
• Serper — web search used to look up a business’s phone number when you ask ClawCall to find it.
• Sendblue — SMS and iMessage.
• Clerk — authentication and account management.
• Stripe — subscription billing.
• PostHog — product analytics.
• Railway — application hosting and database.
• S3-compatible storage — temporary recording storage.

Remote MCP clients connect through OAuth 2.1 authorization code flow with PKCE. Authorization codes, access tokens, and refresh tokens are stored as hashes; ClawCall API keys are not copied into ChatGPT, Claude, or other connected hosts. Access tokens are short-lived, refresh tokens rotate on use, and connections can be revoked.

Recordings and transcripts are visible only to the account that placed the call. Recordings are stored in our object storage bucket; download URLs are short-lived. Transcripts are stored in our database alongside the call record. ClawCall deletes transcripts 7 days after a call ends and recordings 10 minutes after a call ends. The recording itself is deleted, not just its link.

Every call, every time: when the called party asks whether they are speaking with a person, ClawCall confirms it is an AI calling on behalf of the account holder. No account setting can turn this off. Why ClawCall always says it is an AI when asked.

• No HIPAA attestation today. ClawCall can give your own health details to a business or agency for your errand and request your own records, including for a family member you manage errands for.
• No PCI attestation today. Tasks, transcripts and recordings are stored. For passwords, live one-time codes and full card numbers, prefer live loop-in or a private consult so the value is spoken live instead of stored in the task. Joining a call does not promise that recording or transcription stops.
• Protect the recipient's information. Never ask a call recipient for their own card details, SSN or other government ID, passwords, one-time codes or health information. Your own details, including date of birth, address, account or member numbers, insurance IDs and PINs, may be given to a business or agency for your errand.
• No SOC 2 attestation today. We'll publish when we have one.
• Instruction-controlled voicemail. If no human answers, ClawCall can leave a concise voicemail when your task asks for one.
• No bulk or robocall-style promotions. Individual outreach calls are allowed.

Email support@clawcall.dev or file a GitHub Security Advisory. We aim to triage within 48 hours.

Privacy Policy · Terms and Conditions