Security and data handling

This page describes obligations that travel with the data, not just good practice. It is reviewed alongside Talki’s DPA.

What flows through this API

Personal data of your customer’s callers: phone numbers, names, appointment details, and a generated summary of what was discussed on a call. Treat every response as personal data under the GDPR.

What Talki retains

• Call records and related caller data are purged on a rolling 365-day retention window.
• Webhook delivery logs, including payloads and receiver response excerpts, are retained for 30 days.
• An account scheduled for deletion loses API access immediately and is erased after a 30-day grace period unless the owner cancels the request.
• Verbatim transcripts and audio are not exposed through this API, as a standing policy rather than an accident of the current schema.

Your obligations

• Store credentials server-side, encrypted at rest.
• Verify webhook signatures against the raw body and reject stale timestamps.
• Minimise: pull the fields you need, not whole resources you will not read.
• Honour deletion. If a Talki record disappears, mirror that downstream.
• Never copy production payloads into documentation, tickets or test fixtures.

Reporting a vulnerability

Email info@talki.it with the subject Security report. Do not include API keys, webhook secrets, or caller data in the message. Include the affected hostname, a minimal reproduction, impact, and a safe way to contact you. Talki will acknowledge the report and coordinate validation and disclosure; no fixed response-time commitment is published during the private beta.