> ## Documentation Index
> Fetch the complete documentation index at: https://docs.ringg.ai/llms.txt
> Use this file to discover all available pages before exploring further.

> ## Agent Instructions
> To search or read these docs, connect the Ringg docs MCP server at https://docs.ringg.ai/mcp (no key needed; tools search_ringg_ai and query_docs_filesystem_ringg_ai) instead of browsing pages one by one. Setup for each client: https://docs.ringg.ai/resources/mcp-server/docs-mcp-server/mcp-for-ai-assistants.md
> The dashboard labels agents "Assistants"; these docs say "agent". Both mean the same object, identified by agent_id.
> API base URL: https://prod-api.ringg.ai/ca/api/v0. Send the workspace API key in the X-API-KEY header, from server-side code only.
> Placing a call dials a real phone number and spends credits. Confirm the number with the user before calling.
> To act on a Ringg workspace (place calls, edit agents, read transcripts), use the separate Ringg workspace MCP server at https://mcp.ringg.ai/mcp: https://docs.ringg.ai/resources/mcp-server/workspace-mcp-server/overview.md

# Security

> Ringg AI security: SOC 2 Type II, ISO 27001, HIPAA and GDPR status, BAA and DPA requests, data deletion, and how to secure your own integration.

What Ringg does to protect your data, and what to do on your side of the integration.

## What Ringg does

### Certifications and compliance

> [card] SOC 2 Type II
>
> Audit of the design and operating effectiveness of Ringg's controls over a defined period.

> [card] ISO 27001
>
> Certified to the international standard for information security management systems.

> [card] GDPR
>
> Supports data-subject rights and safeguards for cross-border transfers, as described in the [Privacy Policy](https://www.ringg.ai/privacy).

> [card] HIPAA
>
> Supports appropriately configured voice AI workflows for healthcare organisations.

Certificates, reports and the latest audit status are in the [Compliance Trust Center](https://ringg-ai.in.trust.site/).

### Agreements

Regulated data needs the matching agreement in place before it goes through Ringg:

| Agreement | When you need it |
| - | - |
| Business Associate Agreement (BAA) | Before protected health information (PHI) passes through Ringg in a covered healthcare workflow. It must be signed first. |
| Data Processing Addendum (DPA (Data processing agreement: the contract covering how Ringg processes personal data for you.)) | To set out how personal data is processed and what Ringg and you are each responsible for |
| Standard Contractual Clauses (SCCs) | As a transfer mechanism when personal data moves between countries |

To request any of them, or to check which apply to your use, email [admin@ringg.ai](mailto:admin@ringg.ai).

### Request access to or deletion of personal data

To access, correct or delete personal data about you, email [admin@ringg.ai](mailto:admin@ringg.ai). Include enough to identify the account or data, and nothing more sensitive than that.

Ringg may need to verify your identity first. Some information is kept where the law requires it, or for security, fraud prevention, dispute resolution or contractual reasons.

### Other requests

For compliance reports, certificates, security questionnaires, the subprocessor list or data-protection questions, email [admin@ringg.ai](mailto:admin@ringg.ai).

### Examples in these docs

All data in these docs is made up. Acme Lending, Priya Sharma, and the phone numbers, IDs and API keys in code samples, screenshots and videos are invented. No real customer data, credentials or personal information appears anywhere in the docs. Replace the examples with your own values when you use them.

## What you do

### API key

The [API key](https://docs.ringg.ai/documentation/manage-account/api-key.md) authenticates every API request for one workspace.

* Follow [Store it safely](https://docs.ringg.ai/documentation/manage-account/api-key.md#store-it-safely): server-side only, from a secret manager, never in a browser page, mobile app, public repository, chat or email.
* If it may have leaked, [rotate it](https://docs.ringg.ai/documentation/manage-account/api-key.md#rotate-the-key) and update every service that uses it.
* Set a credit balance [alert](https://docs.ringg.ai/documentation/monitor/alerts.md) so unexpected spending shows up quickly.

The web widget does not use this key; never put it in an embed. Each webcall agent has its own key in the embed snippet, limited to the sites under **Allowed clients**; rotate it from [Web widget overview](https://docs.ringg.ai/documentation/deploy/web-and-apps/web-widget/overview.md#rotate-the-webcall-key). [MCP clients](https://docs.ringg.ai/resources/mcp-server/workspace-mcp-server/security-and-faq.md) have their own sign-in and revocation.

### Webhook endpoints

* Accept events only over HTTPS.
* Put a secret you control in the subscription's `headers`, such as `X-Webhook-Secret`, and reject requests without it. See [Authentication patterns](https://docs.ringg.ai/documentation/build-agents/customize-agent-behaviour/webhooks/setup-and-errors.md#authentication-patterns).
* Dedupe on `call_id` plus `event_type`, so a repeated delivery is not processed twice.

### Dashboard access

* Sign-in is **Continue with Google** or **Continue with Email**, which sends a 6-digit one-time code, so secure that Google or email account with two-step verification.
* Give members only the access they need. New members start as **View only**, and edit access is granted per area. See [Members](https://docs.ringg.ai/documentation/manage-account/members.md#roles-and-permissions).
* Remove people who leave, and review [Workspace logs](https://docs.ringg.ai/documentation/manage-account/members.md#workspace-logs) for changes you don't expect.

### Personal data

* Send only the data the agent needs in `custom_args_values` and CSV columns. Every variable you send is stored with the call.
* Never put secrets or sensitive data in the widget's `variables`; they are visible in the browser.
* Recording links in the API and webhooks may expire; fetch a fresh one from [Get Call Details](https://docs.ringg.ai/api-reference/monitoring/call-history/get-call-details.md). Download the recordings you must keep into your own storage, under your own retention policy.
* To have personal data deleted, follow [Request access to or deletion of personal data](https://docs.ringg.ai/resources/security/security.md#request-access-to-or-deletion-of-personal-data).

### Calling rules

You are responsible for how your calls meet the rules where your callees are.

* Tell people they are talking to an AI agent, and that the call is recorded, where the law requires it.
* Honour opt-outs and do-not-call requests, and use [Call limits](https://docs.ringg.ai/documentation/manage-account/call-limits.md) and the agent's [calling window](https://docs.ringg.ai/documentation/build-agents/customize-agent-behaviour/call-settings.md#calling-window) to keep contact within your policy.
* Follow the privacy and industry rules that apply to you, such as GDPR, HIPAA or PCI DSS, and keep a record of the measures you take.

## Next steps

> [card] [Secure your integration](https://docs.ringg.ai/resources/security/security.md)
>
> Protect keys, webhooks and call data on your side.

> [card] [Protect your API key](https://docs.ringg.ai/documentation/manage-account/api-key.md#store-it-safely)
>
> Store and rotate the workspace key.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.