Security and data handling

These obligations apply wherever you store the data, alongside Talki’s DPA.

What flows through this API

Personal data of your customer’s callers: phone numbers, names, appointment details, a generated summary of each call, and the assistant’s one-line record of a question it could not answer. Treat every response as personal data under the GDPR.

Retention

• Call records and related caller data — including unresolved requests — are purged on a rolling 365-day retention window.
• Webhook delivery logs, including payloads and receiver response excerpts, are retained for 30 days.
• An account scheduled for deletion loses API access immediately and is erased after a 30-day grace period unless the owner cancels the request.
• Transcripts are deleted with their call, and when the account stops keeping transcripts. Call audio is not exposed through this API.

Your obligations

• Store credentials server-side, encrypted at rest.
• Verify webhook signatures against the raw body and reject stale timestamps.
• Store only the fields you use.
• Honour deletion. Act on contact.deleted, call.deleted, service.deleted and resource.deleted. Feeds carry no tombstones, so also walk contacts, services, resources and unresolved requests in full periodically: a record gone from Talki must also be gone downstream.
• Never copy production payloads into documentation, tickets or test fixtures.

Reporting a vulnerability

Email info@talki.it with the subject Security report. No API keys, webhook secrets or caller data in the message. Include the affected hostname, a minimal reproduction, the impact, and a safe way to reach you. You will receive an acknowledgment and coordinated disclosure; there is no fixed response time during the private beta.