Locked instructions
The agent’s instructions are assembled server-side and never exposed to callers.
Security & data
Security is built into how CoveCall is structured — not bolted on. Here’s how your data and your calls are protected, described at a safe, public level.
Your data is isolated
Section titled “Your data is isolated”Every record belongs to a business, and the database enforces row-level security so a user can only ever read or change rows for businesses they belong to. Roles (owner, admin, agent, and custom roles) further limit what each person can do.
Credentials are encrypted
Section titled “Credentials are encrypted”When you connect an integration, its credentials are encrypted at rest and readable only by trusted server-side roles — never exposed to the browser or to callers. Webhooks and custom actions are signed so your systems can verify a request genuinely came from CoveCall.
Live audio uses short-lived, signed access
Section titled “Live audio uses short-lived, signed access”The browser never holds a standing key to the voice engine. Each live audio session — including owner take-over — is authorized with a short-lived, signed ticket scoped to that one call.
The agent is hardened against manipulation
Section titled “The agent is hardened against manipulation”Neuros is designed so a caller can’t talk it into misbehaving:
Untrusted caller input
Caller speech is treated as untrusted data. “Ignore your instructions” is detected and deflected — it never reaches the model as a command.
Tool allow-list
The agent can only use the tools you’ve enabled, and every tool call is checked before it runs (for example, transfers are forced to your own forward number).
No leaks
Output is guarded so Neuros won’t read out private numbers, internal notes, or its own configuration.
Privacy, recording & retention
Section titled “Privacy, recording & retention”- CoveCall transcribes and summarizes calls so you get accurate records. Recording and consent laws vary by region — see Registration & consent for how to stay clear (often a line in your greeting is enough).
- For medical practices, HIPAA mode enables PHI-safe handling, consent prompts, and minimum-necessary capture.
- You can delete your account — and your business, numbers, and call data — from Settings.