Security

Calls and data move over encrypted connections (TLS), and the data we store is encrypted at rest. Your information is protected both on the wire and on disk.

Penny runs on Amazon Web Services using a serverless architecture — managed, regularly patched, and isolated by design. We rely on AWS's physical and network security so our team can focus on protecting your application data.

Every part of the system gets only the permissions it needs and nothing more. Internal access to production is limited to the people who need it, and tenant data is isolated so one business's calls and records are never visible to another.

Payments run through our PCI-compliant payment processor. Card details go straight to them — full card numbers never touch Penny's servers.

Per-tenant spam screening blocks unwanted numbers before a call ever reaches the assistant, and number provisioning and call routing are guarded so calls go only where you've configured them to.

We monitor calls and service errors to identify problems. Configured fallback options can take a message or route a call to voicemail when normal handling is unavailable. The call record helps your team see what happened and follow up.

You decide what Penny can do and which numbers are blocked or allowed. Configurable retention is available on Business. You can delete records from your dashboard at any time.

If you believe you've found a security issue, please email support@pennyassistant.com and we'll respond quickly. We're grateful to researchers who report responsibly, and we ask that you give us a chance to fix an issue before disclosing it publicly. If your organization needs a security review or documentation for a specific compliance requirement, get in touch — we're happy to help.