Security & trust

How we protect your data

This page is maintained by Risacare Ventures to answer common questions about how Risacare handles your business data and your callers' information. It describes the controls we operate today; it isn't an independent certification.

Access & authentication

Email + password sign-in with support for OAuth.
Session tokens are short-lived and rotate on sign-in.
Owners can invite teammates and revoke access at any time from the dashboard.

Data in transit and at rest

All web and API traffic is served over HTTPS.
We do not record or transcribe your calls. Risacare never answers a call in conversation, so there is no call audio and no transcript to store — the smallest way to protect that data is not to hold it.
What we do store for a caught call: the time, the shop it belongs to, how long the text back took, and the caller's number in masked form for the count. Caller replies are stored as leads so you can call back.
Data at rest sits with our infrastructure providers under their encryption-at-rest defaults.
Secrets and integration tokens are stored encrypted, separate from application data.

Retention

Missed-call records and lead messages: kept while your account is active, so your own history stays yours.
Opt-out records (callers who replied STOP): kept indefinitely — deleting one would let a text reach someone who asked us to stop.
Deletion on request within 30 days — email privacy@risacareventures.com.

Shared responsibility

Risacare operates the platform and the controls listed above. As the account owner you're responsible for keeping your login credentials safe, managing which teammates have access, and honoring caller opt-outs where applicable.

Report a vulnerability

Please email security@risacareventures.com with reproduction steps. We acknowledge reports within 2 business days and won't take legal action against good-faith researchers.

See our Privacy Policy and Terms of Service.