Tenant and application isolation
Every application belongs to one developer workspace. Agents, customers, calls, and recordings are scoped to that application and are not shared across tenants.
Security and privacy
Context-aware does not mean context-everywhere.
Applications control the fields they send and which fields agents may see. Customer, agent, and developer access are scoped separately. This page describes the controls in the platform today and the ones still being built.
Controls in place today
Separate identities
Customers, support agents, and developers authenticate through distinct flows with distinct authorization scopes. An agent cannot use a developer console, and a customer cannot enumerate agents.
Call-scoped capabilities
Support capabilities are bound to one call and cannot be replayed to join an unrelated conversation. TURN and upload credentials expire quickly. The current agent recovery capability can last up to seven days; after a call ends, it is restricted to terminal status and consent-audited artifact finalization.
Encrypted media in transit
Call audio uses WebRTC with peer-to-peer media where the network allows and a TURN relay fallback otherwise. Media is encrypted in transit on both paths.
On-device transcription
Speaker tracks are transcribed on the agent's device. Raw audio is not sent to a third-party speech service as part of the default flow.
Private recording storage
Recordings and transcripts are uploaded to private, S3-compatible storage using short-lived, call-scoped URLs, and are readable only by authorized reviewers.
Privacy policy
How RingDesk handles personal data
Effective 27 August 2026. This notice applies to RingDesk customer, agent, developer, and SDK services.
Data collected
Account and workspace details; customer name, contact details, identifiers, and application-provided fields; agent availability and optional routing location; call metadata; and, when enabled with notice and consent, call audio, screen content, recordings, transcripts, and annotations.
Purpose
We use this data to authenticate users, route and operate support calls, provide screen collaboration, prevent abuse, troubleshoot reliability, produce customer-authorized records, and meet legal obligations. RingDesk does not use SDK data for cross-app tracking or advertising.
Sharing and protection
Data is disclosed only to the host application's authorized workspace users and service providers needed to operate hosting, notifications, relay media, and private storage. Transport is encrypted and access is tenant- and application-scoped. We do not sell personal data.
Retention and deletion
The standalone customer app creates no RingDesk sign-in account; the host application is the first contact for customer-profile correction or deletion. Where a deployment reports production deletion processing as configured, signed-in agents and developers can request account and associated-data deletion, cancel for 7 days, and then enter permanent processing. New email/password identities must verify their email before sign-in; identities still unverified after 7 days are permanently deleted by bounded housekeeping. Until the deployment check passes, RingDesk does not promise automatic completion. Uploaded recordings and transcripts currently remain until account deletion completes or an application is disabled beyond its recovery window; a general automatic retention period is not yet available. A deployment that enables recording must publish and operate an appropriate retention schedule. Certain security, dispute, or legal records may be retained where required.
Your choices
Microphone, notification, camera, location, and screen-capture access can be declined or revoked in device settings. Screen capture starts only after the operating-system consent flow. Contact the host application first for profile access, correction, export, or deletion because it controls the customer relationship.
Children and changes
RingDesk is a business support service and is not directed to children. Material changes will be posted here with a new effective date. Privacy questions can be sent to privacy@ringdesk.app.
In progress
We publish these as roadmap items rather than claims. Ask us for current status before making a compliance decision.
- Signed webhook delivery with replay protection
- Workspace-configurable recording retention periods
- Customer-owned recording export connectors
- Workspace audit log views
- Self-service data export workflows
- Published subprocessor list and regional processing options
Recording consent
Consent is a shared responsibility.
RingDesk provides consent-aware recording controls and records only when recording is enabled for the call. You remain responsible for the disclosure language, the legal basis, and the retention rules that apply in the markets you operate in.
Agent performance metrics are provided for operational visibility. They are not designed or marketed as an opaque employee-ranking system.
- Recording is per-call and controllable by the agent
- Customer and agent tracks stay separated
- Transcripts are generated on the agent device
- Recording access is limited to authorized reviewers
What RingDesk does not do
Scope limits are part of the security story.
- No PSTN phone numbers or carrier service
- No outbound sales dialing
- No omnichannel inbox or system of record
- No autonomous AI voice agents
- No calling without an internet connection
Questions about the security model?
Ask for the current architecture review before you build against RingDesk.