Security

Calls and data move over encrypted connections (TLS), and the data we store is encrypted at rest. Your information is protected both on the wire and on disk.

Penny runs on Amazon Web Services using a serverless architecture — managed, regularly patched, and isolated by design. We rely on AWS's physical and network security so our team can focus on protecting your application data.

Every part of the system gets only the permissions it needs and nothing more. Internal access to production is limited to the people who need it, and tenant data is isolated so one business's calls and records are never visible to another.

Payments run through our PCI-compliant payment processor. Card details go straight to them — full card numbers never touch Penny's servers.

Per-tenant spam screening blocks unwanted numbers before a call ever reaches the assistant, and number provisioning and call routing are guarded so calls go only where you've configured them to.

We trace calls end-to-end and monitor the service so we can catch problems early. If something fails, Penny is designed to degrade gracefully — taking a message rather than dropping the call — so a caller is never left at a dead end.

You decide what Penny can do, how long records are kept, and which numbers are blocked or allowed. You can delete records from your dashboard at any time.

If you believe you've found a security issue, please email support@pennyassistant.com and we'll respond quickly. We're grateful to researchers who report responsibly, and we ask that you give us a chance to fix an issue before disclosing it publicly. If your organization needs a security review or documentation for a specific compliance requirement, get in touch — we're happy to help.