Native authentication and authorization mechanisms are used for the integrations built with our partners to ensure that permissions and data are accessed through verified protocols such as OAuth. Dialpad also gives customers control to manage the integrations to turn on and off data or permission access at the source. Furthermore, Dialpad goes through regular security reviews of its integrations with providers such as Google and SalesForce to be listed on the providers’ application directories.

Call blocking and spam prevention features are provided to each user. Dialpad also performs spam recognition and gives capabilities for users to block callers with high spam scores. See the following page for additional details

Quarterly penetration tests are run by an independent third-party tester on our new features and products to test against web application attacks, such as those identified within the OWASP Top 10. Dialpad also enables security scanners and security checks in continuous integration pipelines to ensure that common web application attacks are mitigated prior to deploying new releases. Dialpad also implements technical controls such as rate-limiting to protect against unauthorized traffic attacks.

Dialpad follows the NIST Guidelines for incident response. Per our Terms of Service and contractual obligations, Dialpad will notify customers of any breach involving their data. Dialpad is committed to compliance with all applicable breach notification laws and regulations.

To protect our customers’ data and fulfill our legal obligations, Dialpad has adopted a standardized and stringent review process for all government data requests, and commits to notifying customers of such requests unless prohibited by law. Read more about Dialpad’s review process and view our transparency reports.

All permanent customer data, such as contact lists, call records, recordings, and transcripts, is stored in the United States via Google Cloud Platform, and backed up daily. Transient customer data through Dialpad's data centers is held for no more than 72 hours.