Security
How we protect your data
Your contacts, calls, recordings and texts are your business. Here's how TopReach keeps them safe, where they're stored, and how you stay in control of them.
At a glance
- Encryption
- Data is encrypted in transit over public networks and encrypted at rest with our cloud providers' encryption.
- Access
- Role-based access for your team (Owner, Administrator and Team Member roles) and least-privilege, strongly authenticated access for our staff.
- Data location
- We and our service providers store and process data in Canada, the United States and other countries where those providers operate.
- Your control
- Export your data, set recording rules for your workspace, turn AI transcription off, and delete your account from the app or the web.
Protecting data
- Encryption of data in transit over public networks, and encryption of stored data using our cloud providers' encryption at rest.
- Logical separation of each customer's data.
- Regular backups, with restore procedures.
- Secure storage of credentials and secrets.
- Patching and vulnerability management for our systems and software dependencies.
Controlling access
Inside your workspace, Owner, Administrator and Team Member roles decide who can see and change what. Admins decide whether calls are recorded for everyone, no one, or each user's choice, and can turn AI transcription off for the whole workspace.
On our side, staff access to production systems uses strong authentication and least privilege, is logged and monitored, and is removed promptly when it's no longer needed.
- Sign in with email and password, Google, or Apple on iPhone.
- The phone apps can be locked with Face ID on iPhone, or your fingerprint or face on Android.
- API keys for your own integrations are created and revoked in your workspace settings.
Building and running TopReach
- Secure development practices, including code review before every release.
- Logging and monitoring of access to production systems.
- Incident response procedures. If a breach creates a real risk of significant harm, we notify the affected people and regulators as the law requires.
- Confidentiality obligations and security awareness for our staff.
- Security reviews of, and data protection terms with, the service providers that process customer data.
Who processes data for us
We use a small set of service providers: cloud hosting and databases; Twilio and the carriers it connects to, for calling, texting and phone numbers; Mailgun for email delivery; Google services, if you use Google sign-in or connect Gmail; Stripe for card payments (we never receive full card numbers); Intercom for support chat; and analytics and error monitoring. Our Data Processing Addendum lists the categories and gives at least 15 days' notice before a new one starts.
Keeping, exporting and deleting data
- Your data stays until you delete it while your account is active.
- After a subscription ends, there's a 30-day window to export your data; we then delete it from active systems within the following 60 days, and backups are overwritten in our normal cycle.
- You can delete your account from Settings in the TopReach app on your phone, or by following the steps on our delete-account page.
Report a security issue
If you think you've found a vulnerability in TopReach, email support@gettopreach.com with "Security" in the subject and the details to reproduce it. Please give us time to fix it before sharing it publicly, and don't access or change other customers' data while testing. If you think your own account has been compromised, tell us right away at the same address.
Your calls, your data, your control.
Start free and set up your workspace the way your team works.