This page lists Tried's security controls with an honest status for each. Built means the control is in the application code and works in every deployment. Deployment means it depends on how the platform is hosted and configured (see the operator's go-live checklist). Nothing here is a certification.
Tenant isolation#
| Control | Status |
|---|---|
Every record carries a workspace_id; every query is scoped to the authenticated workspace; the API never takes a workspace ID from the request body |
Built |
IDs are random (96 bits after a type prefix such as call_ or agent_), so they can't be guessed or enumerated |
Built |
Requests for another workspace's IDs return 404 |
Built |
Postgres row-level security as a second layer (apps/api/prisma/rls.sql) |
Deployment, optional |
Authentication and access#
| Control | Status |
|---|---|
| Secret API keys stored as SHA-256 hashes plus an encrypted copy; shown once; masked afterwards | Built |
| Per-key scopes, IP allowlist and rate limit | Built (API keys) |
| Public keys restricted by domain, route, agent, reCAPTCHA v3, rate and country | Built; reCAPTCHA Needs keys (Public keys) |
Signed, HttpOnly, SameSite=Lax session cookies; Secure in production; 30-day lifetime |
Built |
| Passwords hashed with bcrypt; sign-in, sign-up and reset rate limited per IP and email; timing-safe failure | Built |
| TOTP two-factor authentication with one-time recovery codes | Built, optional per user (Sign-in and 2FA) |
| OIDC SSO with ID token verification, SAML 2.0, SCIM 2.0 provisioning | Built (SSO, SAML and SCIM) |
| Roles: Admin, Developer, Member (read-only), checked on every route | Built (Users and roles) |
| Audit log of key, member, sign-in, privacy, export and billing events | Built (Audit log) |
| Production refuses to boot with development secrets or with development sign-in on | Built |
Data protection#
| Control | Status |
|---|---|
| Per-agent data storage modes, PII scrubbing with beeped recordings, retention purge | Built (Data storage and retention) |
| Unscrubbed copies encrypted (AES-256-GCM), admin-only reveal, audited, expire after 30 days by default | Built |
| Recording links always signed; per-agent expiry | Built |
| Delete all data for a phone number | Built |
Stored credentials such as API key copies encrypted with a key derived from SESSION_SECRET |
Built |
| S3 buckets private with server-side encryption; database encryption at rest | Deployment |
| TLS for the API and dashboard; SIP over TLS with SRTP for phone media | Deployment (transport: "TLS", media_encryption: "required" on trunks) |
| Data residency in Australia (Sydney region for database, storage, media and Deepgram AU endpoint) | Deployment |
Model and voice providers process call audio and text. Where a provider runs outside your region, data leaves the region for that step. Choose providers and regions to match your obligations.
Outbound requests and webhooks#
| Control | Status |
|---|---|
| Requests to customer URLs (webhooks, workflow steps, knowledge base crawling, OIDC discovery) refuse private, loopback, link-local, CGNAT, multicast and reserved addresses, checked on the address actually dialled | Built |
| Custom function calls from the voice runtime use the same protection | Built |
Webhooks signed with HMAC-SHA256 in x-tried-signature (v=<timestamp>,d=<hex>), also sent as x-retell-signature |
Built (Webhooks) |
| Custom function requests signed the same way | Built |
| Fixed egress IP addresses you can allowlist | Deployment. GET /workspace/egress returns them when the operator sets EGRESS_IPS; otherwise it says they are not fixed |
Egress proxy (HTTPS_PROXY) |
Deployment |
Application security#
| Control | Status |
|---|---|
| Every request body validated with zod schemas; unknown fields dropped; server-controlled fields never read from bodies | Built |
Per-IP and per-key rate limits with 429 and rate limit headers |
Built |
| Security headers: CSP and HSTS from the API in production | Built |
| WAF, managed rule sets | Deployment |
Telephony abuse#
| Control | Status |
|---|---|
| Concurrency limits, CPS per number, reserved inbound slots | Built |
| Country allowlists per number for inbound and outbound calls | Built |
| Prepaid credit, monthly budget with 80% and 100% alerts | Built |
| Business verification before numbers, outbound calls and SMS | Built, enforced when the operator turns it on (Business verification) |
| Do-not-call list on contacts, honoured when requested | Built |
| STIR/SHAKEN attestation, CNAM, A2P 10DLC and AU sender IDs | Deployment (carrier registration) |
See Prevent abuse for how to configure these.
Compliance status#
Tried does not claim any compliance certification or attestation (for example SOC 2, ISO 27001, HIPAA or PCI DSS). The controls above support your own obligations, such as the Australian Privacy Principles, but your deployment, providers and contracts determine compliance.
Do not collect payment card numbers in conversations. With Everything except PII, card numbers that pass the Luhn check are redacted after the call, but they still pass through the speech and language providers during the call.
Report a security issue#
Contact the operator of your Tried deployment. Include the workspace ID, the time, and the request IDs or call IDs involved.