Security & compliance
Last updated September 17, 2026
CallFlowHQ operates in the mortgage industry, where compliance and data handling aren't optional. Here's what that means concretely in how the product is built.
The AI is built to never quote a rate
Every agent runs with a fixed set of compliance guardrails -- no rate, APR, or loan-term quotes, no Social Security number or date of birth collection, no product recommendations -- built into its configuration by default. No account setting can turn these off or weaken them; an account can only add its own rules on top. Every call opens with a clear statement that the caller is speaking with an AI, and the agent is instructed to hand off to your licensed loan officer the moment a rate, term, or recommendation comes up. As a second layer, every finished call is automatically screened afterward for a possible miss, which gets flagged for your review rather than going unnoticed. If a caller asks to stop being contacted, the agent treats that as a hard stop -- it doesn't push to transfer the call or keep verifying identity -- and logs the request for your team to act on.
Your data stays yours
Your account's data is walled off from every other account, down to the database itself -- not just checked by application code that a future feature could get wrong. Sub-accounts are isolated from each other the same way a parent account is isolated from every other customer. Our own staff don't have standing access to customer data -- any support access is logged, approved, and requires an extra layer of login verification.
Encryption
All calls and stored data are encrypted -- both in transit, while moving between systems, and at rest, while stored.
Certifications
SOC 2 Type I is on our roadmap -- we haven't completed a formal third-party certification yet, but it's an active commitment, not a someday. Security documentation and details on our practices are available on request in the meantime -- email support@callflowhq.com.
Call recordings and transcripts
Calls are recorded and transcribed so you can review them, with compliance flags surfaced automatically rather than requiring you to listen to every call. See our Privacy Policy for how that data is retained and who can access it.
Reporting a concern
If you believe you've found a security issue, email us at support@callflowhq.com and we'll follow up directly.