What this page is
A description of the security controls Shravan.ai actually operates, written from a line-by-line review of the running system rather than from a template. We hold no SOC 2, ISO 27001 or HIPAA certification and we make no claim to be “DPDP compliant” or “GDPR compliant”: those are conclusions for an auditor or a lawyer, not for us. What follows is what the software does.
Keeping customers apart
Every workspace is isolated at the database query, not at the screen. Each request is resolved to exactly one workspace from the credential that carried it, and every route that reads or writes workspace data re-checks that association on the server. It is not possible to reach another customer’s calls, transcripts, recordings, knowledge base, webhooks, API keys or billing by changing an identifier in a URL.
This is enforced by an automated suite that walks the entire API surface before every release: each route is called with one customer’s credentials against another customer’s real object identifiers, and the release fails if a single one succeeds. Because the suite reads the live route table, an endpoint added tomorrow is covered the day it is added.
Authentication and API keys
Console sign-in uses Google Firebase Authentication; tokens are verified on our servers against Google’s public keys, including issuer, audience and expiry. An email address that has not been verified grants nothing, so signing up with someone else’s address does not reach their workspace.
API keys are scoped. A key carries one workspace and an explicit list of permissions
(read calls, write calls, manage knowledge, and so on), and every permission is checked on
the server for every request. Keys are stored only as hashes — we cannot show you an
existing key, only issue a new one — and each key carries its own rate limit and an
optional IP allow-list. Test keys (sk_test_) and live keys
(sk_live_) address separate worlds: a test key cannot read live calls, live
transcripts or live webhook endpoints, and cannot place a real call or spend real money.
Calls, recordings and transcripts
Call recording is off by default and is turned on per workspace. Where it is on, the agent says so at the start of the call, and it identifies itself as an AI in the same breath — both are enforced by the platform, not left to whoever wrote the script: a call flow that omits either is refused at publish time, and the runtime says the missing sentence itself if one somehow gets through.
Recordings are stored in a private bucket, are never publicly addressable, and are served only through an access-checked endpoint or a signed link that expires (one hour by default). Transcripts are workspace data under the same isolation as everything else, and both recordings and transcripts have retention periods after which they are removed.
Webhooks
Webhook deliveries are signed so you can verify they came from us. In the other direction, a URL you give us is validated before we ever call it: only HTTPS, and only to a public address — loopback, private ranges, link-local and cloud metadata endpoints are refused, redirects are not followed, and the address that passed the check is the address that is dialled, so a DNS record that changes in between does not help an attacker.
Payments
We never see or store card details; payments run through Razorpay. Every payment notification is signature-verified, checked for the right currency and status, and matched to an order on our side rather than trusted from the browser. Wallet credits are recorded in an append-only ledger with a database-level uniqueness constraint, so a duplicated or replayed payment notification cannot credit an account twice.
Carrier callbacks
Every webhook from a telephony carrier is signature-verified, and verification cannot be switched off in production. A signature is accepted once: a captured callback replayed later is refused.
Transport and infrastructure
All traffic is HTTPS with HSTS; HTTP redirects to HTTPS. The application runs in containers on a dedicated server in the European Union, with the database reachable only on an internal network and never from the internet. Backups of the database run nightly. Administrative interfaces are not exposed publicly and require separate credentials.
What we watch
Errors are tracked with personal data suppressed — phone numbers, email addresses and transcript text are stripped before an error report leaves our servers. Authentication failures, workspace authorisation failures and unusual call volume are logged. Application logs are retained for a limited period and are not used for anything other than operating and debugging the service.
What we are still working on
Honesty is more useful to you than a clean page. We do not yet have an independent penetration test, a published uptime commitment, or customer-facing audit logs. Recordings and the database currently live on one server with nightly backups; off-site backup and a tested restore procedure are in progress. If any of these matters to your decision, ask us where it stands before you sign rather than after.
Reporting a vulnerability
If you believe you have found a security problem, email security@shravan-ai.tech. Tell us what you found and how to reproduce it; we will acknowledge within three working days and keep you updated until it is resolved.
Please test only against your own workspace and your own data. Do not access, modify or delete anyone else’s information, do not place calls to numbers you do not control, do not run denial-of-service or high-volume automated scanning against the service, and do not test our suppliers’ systems. We do not currently operate a paid bug-bounty programme, and we cannot offer legal safe harbour until that language has been reviewed by counsel — but we will not pursue anyone who reports a genuine issue in good faith and within these limits.
Out of scope: reports generated by an automated scanner with no demonstrated impact, missing headers with no exploit path, weaknesses in third-party services we merely use, and social engineering of our staff or customers.
Security incidents
If an incident affects your data we will tell you what happened, what data was involved and what we are doing about it, as quickly as we can establish the facts, and we will cooperate with the reporting obligations that apply to us. Our security contact for incidents is security@shravan-ai.tech.