Security

RevDesk is operated by Cell Labs, Inc. This page covers how we secure your data: encryption, access controls, and compliance posture. It also covers how to report a vulnerability, because we welcome coordinated disclosure from the security research community.

If you have discovered a security vulnerability in RevDesk, we encourage you to let us know right away. We welcome the opportunity to work with you to resolve the issue promptly, and you may submit reports anonymously.

Submit your findings directly to our HackerOne inbox; anonymous reports are welcome. If you'd rather report by email, write to security@revdesk.com.

Our machine-readable contact details are published at /.well-known/security.txt.

We encrypt your data in transit and at rest so it stays protected from unauthorized access, disclosure, alteration, or destruction.

In transit (TLS 1.2+)

All traffic between you, our services, and our telephony partners is encrypted in transit using TLS 1.2 or higher, with TLS 1.3 on our public web surfaces and SRTP on real-time media.

At rest (AES-256)

Call recordings, transcripts, and account data are encrypted at rest with AES-256.

Encrypted backups

Backups are automated and encrypted, with redundancy across our infrastructure provider's data centers.

Payment data

Card details are processed securely through Stripe. We never store credit card numbers.

Access to customer data is tightly controlled and continuously monitored across our systems and our infrastructure providers.

Authentication

Multi-factor authentication is available on every account, with secure session handling throughout.

Least-privilege access

Role-based permissions enforce least-privilege access to customer data across our team.

Infrastructure

AWS data centers with physical security, redundancy, and automated encrypted backups.

Network security

Firewalls, intrusion detection, and DDoS protection guard our network perimeter.

Security audits

Periodic internal penetration testing, ongoing vulnerability assessment, and a coordinated disclosure program.

Incident response

Documented procedures for security incidents and data breaches, plus vendor security reviews of every third-party provider.

HIPAA: RevDesk supports HIPAA workloads under a signed Business Associate Agreement. Enabling HIPAA mode on a workspace restricts AI routing to BAA-covered providers, strips recordings and transcripts from outbound webhooks and the public API, and defaults call-recording retention to 30 days, adjustable per number afterwards. The sub-processors in the call path are BAA-covered; analytics, error monitoring, and contact enrichment sit outside that boundary and never receive call content.

SOC 2 Type II: We are actively pursuing SOC 2 Type II certification (audit in progress). Our core sub-processors are already SOC 2 Type II certified.

GDPR: We handle personal data in line with the GDPR, including data-subject rights. A complete Article 28 Data Processing Agreement, with the Standard Contractual Clauses incorporated, downloads self-serve from Settings → Security → Compliance.

Our disclosure program is covered by the following standards. Good-faith research conducted under them is authorized.

Coordinated Vulnerability Disclosure

We work with you to validate, remediate, and disclose issues on a coordinated timeline.

Safe Harbor

Good-faith research conducted under these guidelines is authorized. We will not pursue or support legal action against you for it.

Open Scope

Any asset RevDesk (Cell Labs, Inc.) owns or operates is in scope. Third-party services we don't host are out of scope.

Core Ineligible Findings

Reports with no real-world security impact (e.g., missing best-practice headers, theoretical issues with no PoC) are typically not actionable.