Security

Calls and data move over encrypted connections (TLS), and the data we store is encrypted at rest. Your information is protected both on the wire and on disk.

Penny runs on Amazon Web Services using a serverless architecture — managed, regularly patched, and isolated by design. We rely on AWS's physical and network security so our team can focus on protecting your application data.

Every part of the system gets only the permissions it needs and nothing more. Internal access to production is limited to the people who need it, and tenant data is isolated so one business's calls and records are never visible to another.

Payments run through our PCI-compliant payment processor. Card details go straight to them — full card numbers never touch Penny's servers.

Per-tenant spam screening blocks unwanted numbers before a call ever reaches the assistant, and number provisioning and call routing are guarded so calls go only where you've configured them to.

We monitor calls and service errors to find problems. When Penny can't handle a call normally, the call goes to voicemail, and the message is in your Inbox and reaches you by email unless you turn that email off in Settings → Notifications. The call record helps your team see what happened and follow up.

You decide what Penny can do and which numbers are blocked or always put through. You can delete any conversation from your dashboard, and on Business you can set how long Penny keeps conversations.

If you believe you've found a security issue, please email support@pennyassistant.com and we'll respond quickly. We're grateful to researchers who report responsibly, and we ask that you give us a chance to fix an issue before disclosing it publicly. If your organization needs a security review or documentation for a specific compliance requirement, get in touch — we're happy to help.