Your Twilio credentials
Only owners and admins can connect Twilio. Rapidialer stores the Account SID and Auth Token you enter; the Auth Token is encrypted at rest and is never shown back in the app, and agents see only a shortened Account SID.
When you connect, Rapidialer creates an API key and a TwiML app in your account for browser calling and points the voice webhook of each synced number at Rapidialer. Browser calling uses short-lived Twilio access tokens that expire after an hour.
Requests from Twilio
Twilio signs every voice webhook it sends. Rapidialer checks that signature with your Auth Token and rejects any request that fails, so nobody can forge call events or fetch call instructions for your account.
Sign-in and sessions
Passwords are hashed with bcrypt and new accounts verify their email address. You can also sign in with Google. Access tokens last 60 minutes; refresh tokens are stored hashed, rotate on every use, and are revoked when a password is reset. Sign-in and account endpoints are rate-limited.
In production the API only accepts browser requests from the Rapidialer app’s own origin.
Call recordings and call data
When recording is on, Twilio records the call in your Twilio account. Rapidialer stores a reference to the recording and streams the audio from Twilio when a teammate plays it; it does not keep its own copy.
Leads, lists, notes and call history are stored by Rapidialer in a database hosted on AWS behind Cloudflare. Agents see their own calls and their own or unassigned leads; owners and admins see the whole team. Leads and call history can be exported as CSV at any time.
What we do not offer yet
To be clear about the gaps: Rapidialer does not yet support single sign-on (SAML), two-factor authentication or an audit log, and it has no security certifications such as SOC 2. If any of these is a requirement for your team, tell us; it shapes what we build next.
Reporting a security issue
Email connect@rapidialer.com with the details and how to reproduce the issue. Please give us a reasonable chance to fix it before sharing it publicly.