Security and trust
Kwickly Answers keeps each business's calls, bookings and customer records apart from every other business's, uses encrypted connections on its website, portal and hosted pages, and makes an encrypted copy of its database every night. This page says what we do, what we don't do yet, and how to report a security problem. Kwickly Answers serves businesses in the United States only.
In short
- Each business sees only its own records.
- Connections to our website, portal and hosted pages are encrypted, and so are our nightly database backups and weekly picture backups.
- We don't have an independent security audit, an outside break-in test (a penetration test) or two-step sign-in yet.
How we protect your information
- Encrypted connections. This website, the client portal and every page we host are served only over HTTPS, and our servers tell browsers to keep using HTTPS for a year.
- Each business sees only its own records. Every request is checked on our server against the business that is signed in. The database also has row-level security on every table (a second lock inside the database itself). An automated test signs in as one business and tries to read and change another business's records through every part of the portal, and it runs on every change to our code.
- Signing in. Sign-in passwords are handled by our sign-in provider, which keeps only a scrambled (hashed) version. Our own code doesn't save them anywhere else. Repeated sign-in attempts are slowed down. The cookies that keep you signed in can't be read by scripts on the page and are only sent over HTTPS.
- Your sessions. Under Account in the portal you can see where you're signed in, and sign out of every device at once.
- A record of changes. Sign-ins, sign-outs, connections added or removed, customers deleted, downloads, booking changes, refunds, plan changes and settings saves are recorded with who did them and when. A business owner can read their own business's record under Account. It never holds what was said on a call, message text, form answers, card details or passwords.
- Keys and gate codes are encrypted. The keys that connect your other tools, and the gate or door codes you give us, are encrypted (AES-256-GCM) before they are stored.
- Card numbers. Payments go through Stripe, and we don't collect card numbers ourselves. The assistant is set up never to ask for one. If a caller reads a card number out loud anyway, our own copies of the call (the transcript, the summary and the emails) mask it automatically wherever we can recognize it. Our voice provider keeps its own copy of the call, which we can't edit (see Subprocessors). The assistant is also set up never to ask for a Social Security number or a government ID number.
- Nightly backups. A copy of our database (records and sign-in accounts, not uploaded pictures) is made every night, encrypted before it leaves our server, and kept in Google Cloud in Oregon. We keep the last 14 copies, and each copy is deleted after 15 days, so something you delete from the database is gone from these copies within 15 days. We have restored a copy in a test.
- Weekly picture copies. Once a week, a copy of the pictures businesses have uploaded is made, encrypted before it leaves our server, and kept in Google Cloud in Oregon. We keep the last 4 copies, and each copy is deleted after 29 days, so a picture you delete is gone from these copies within 29 days. We have restored a picture copy in a test.
- Error messages. An error shown in your browser never includes database or provider details. Our own error log takes out personal details before it saves anything.
- Checks on our code. Every change to our code is checked automatically for software packages with known serious security problems, for passwords or keys left in the code (across its whole history) and for common coding mistakes. Package updates are proposed every week and read by a person before they go in.
- No trackers. There are no analytics, advertising or session-recording scripts on this website or on the pages we host for businesses.
- Watching for outages. Our website, portal and phone service are checked automatically every few minutes by an outside monitoring service, and we are emailed when one stops answering.
- A plan for incidents. We have a written plan for a security incident. If one affects your business's information, we tell you without undue delay, and within 72 hours of confirming it affects your business. We say what happened and what we are doing, and help you tell your customers.
What we don't have yet
- Two-step sign-in. It is planned, starting with our own staff sign-in.
- An independent penetration test (a paid outside expert who tries to break in). None has been done.
- A SOC 2 or ISO 27001 report (an independent security audit that some larger buyers ask for). We don't have one.
- We keep one nightly backup, in Google Cloud in Oregon, not a second independent one. The weekly picture copies are kept in the same place, also with no second independent copy.
Where your information is kept
Kwickly Answers is for businesses in the United States. Our database is in the United States (Oregon), our servers run on Render in the United States (Oregon), and our backups are in Google Cloud in Oregon. Our traffic passes through Cloudflare's worldwide network on its way to our servers. Some companies that work inside a call or a chat choose for themselves where they run, so information can be handled outside the United States while a call or chat is under way. The companies that handle information for us, and where each one runs, are listed on our Subprocessor list.
Report a security problem
If you think you've found a security problem in Kwickly Answers, email harley@kwicklyanswers.com with "Security" in the subject. Say what you found, where, and how to see it. Please don't look at, change or delete other people's information, don't do anything that slows the service down for others, and give us a reasonable time to fix it before you tell anyone else. We'll reply within 3 business days. We don't pay for reports. We will not take legal action against research that follows these rules.
Our security contact details are also at kwicklyanswers.com/.well-known/security.txt.
For businesses with a security review
If your business needs answers to a security questionnaire before it signs up, email harley@kwicklyanswers.com. We have a short answer sheet, and we'll tell you plainly where the answer is "not yet".
Contact
Kwickly LLC, 18750 Delaware St, Unit 281, Huntington Beach, CA 92648 · harley@kwicklyanswers.com