Build agents with visibility into who can access your data, where requests go, and what gets remembered. Here are the safeguards in the application and the deployment details you should confirm.
Application overview · Updated October 7, 2026
Application safeguards
These describe implemented application controls, not an independent audit of every deployment or provider.
Saved provider credentials use AES-256-GCM encryption with scope-bound authenticated data. The application requires a configured encryption key to unlock them. Tenant credentials and platform-owned configurations are managed separately.
Authenticated routes check workspace membership and permissions. Tenant records are scoped to their organization; platform administration is a separate role. Necessary authorized support and operational access still apply.
Saving call audio and transcripts requires the configured feature and recording consent. Persistent memory has a separate consent choice and expiry. Optional speaker recognition requires a verified account and explicit enrollment and comparison choices. Encrypted, assistant-scoped profiles expire and can be deleted. Voice recognition is never authentication.
Saved call transcripts, audio artifacts, and WhatsApp message content use application-level encryption. Call artifacts have expiry checks and cleanup controls. This is not a claim that every database field or backup is encrypted, or that expired copies disappear everywhere at once.
Versioned knowledge sources, review status, evidence policies, and answer-audit records support source-restricted assistants. These controls help operators inspect answers; they do not certify the documents or guarantee that an AI response is correct.
Call and worker credentials are scoped and time-limited. Public HTTP integrations validate destinations and restrict unsafe network access. Tools, MCP endpoints, and webhooks remain explicit configuration choices, with permissions and approval rules appropriate to the action.
Your API key chooses the provider account. It does not remove Sigsen from the processing path, keep all data in your browser, or override a provider's retention terms. Sigsen is not described as end-to-end encrypted because configured services process conversation data.
A browser, phone service, or WhatsApp channel supplies the conversation. Each channel has its own permissions and processing path.
Sigsen applies the assistant configuration, organization scope, knowledge retrieval, and relevant consent and action controls.
The selected speech and AI providers receive the request data they need. Configured tools receive arguments for authorized actions.
Saved artifacts, memory, messages, source versions, and operational records follow their respective policies. Provider copies have separate controls.
Evidence and deployment
A supported integration or security control is not a compliance certification. Verify the complete workflow before using regulated or particularly sensitive data.
Send a concise description, affected URL or feature, and safe reproduction steps to the contact below. Use your own accounts and synthetic data. Do not access another organization's information, disrupt service, test third-party providers without authority, or disclose customer records. Ask for a suitable secure channel if sensitive evidence is needed.
We assess reported issues, take appropriate containment and remediation steps, and notify affected parties when required by applicable law or agreements. This page does not offer a paid bug bounty or blanket authorization for security testing.
For legal or privacy enquiries, include the relevant organization and the nature of your request. For security reports, include a safe description of the issue. Please do not send passwords, API keys, full recordings, or sensitive customer information.
Signals and Sensors LLC
Registered-agent mailing addressc/o Registered Agents Inc.202 N Cedar Avenue Suite 1Owatonna, MN 55060United States