Security

What Ringg does to protect your data, and what to do on your side of the integration.

​

What Ringg does

​

Certifications and compliance

Certificates, reports and the latest audit status are in the Compliance Trust Center.

​

Agreements

Regulated data needs the matching agreement in place before it goes through Ringg: To request any of them, or to check which apply to your use, email admin@ringg.ai.

​

Request access to or deletion of personal data

To access, correct or delete personal data about you, email admin@ringg.ai. Include enough to identify the account or data, and nothing more sensitive than that. Ringg may need to verify your identity first. Some information is kept where the law requires it, or for security, fraud prevention, dispute resolution or contractual reasons.

​

Other requests

For compliance reports, certificates, security questionnaires, the subprocessor list or data-protection questions, email admin@ringg.ai.

​

Examples in these docs

All data in these docs is made up. Acme Lending, Priya Sharma, and the phone numbers, IDs and API keys in code samples, screenshots and videos are invented. No real customer data, credentials or personal information appears anywhere in the docs. Replace the examples with your own values when you use them.

​

What you do

​

API key

The API key authenticates every API request for one workspace.

• Follow Store it safely: server-side only, from a secret manager, never in a browser page, mobile app, public repository, chat or email.
• If it may have leaked, rotate it and update every service that uses it.
• Set a credit balance alert so unexpected spending shows up quickly.

The web widget does not use this key; never put it in an embed. Each webcall agent has its own key in the embed snippet, limited to the sites under Allowed clients; rotate it from Web widget overview. MCP clients have their own sign-in and revocation.

​

Webhook endpoints

• Accept events only over HTTPS.
• Put a secret you control in the subscription’s headers, such as X-Webhook-Secret, and reject requests without it. See Authentication patterns.
• Dedupe on call_id plus event_type, so a repeated delivery is not processed twice.

​

Dashboard access

• Sign-in is Continue with Google or Continue with Email, which sends a 6-digit one-time code, so secure that Google or email account with two-step verification.
• Give members only the access they need. New members start as View only, and edit access is granted per area. See Members.
• Remove people who leave, and review Workspace logs for changes you don’t expect.

​

Personal data

• Send only the data the agent needs in custom_args_values and CSV columns. Every variable you send is stored with the call.
• Never put secrets or sensitive data in the widget’s variables; they are visible in the browser.
• Recording links in the API and webhooks may expire; fetch a fresh one from Get Call Details. Download the recordings you must keep into your own storage, under your own retention policy.
• To have personal data deleted, follow Request access to or deletion of personal data.

​

Calling rules

You are responsible for how your calls meet the rules where your callees are.

• Tell people they are talking to an AI agent, and that the call is recorded, where the law requires it.
• Honour opt-outs and do-not-call requests, and use Call limits and the agent’s calling window to keep contact within your policy.
• Follow the privacy and industry rules that apply to you, such as GDPR, HIPAA or PCI DSS, and keep a record of the measures you take.

​

Next steps