Security at NextPhone

Your calls are used to run your receptionist, plus support, security, and anything the law requires. Nothing else. We never train AI on them, and we’ve opted out of training with every AI provider we use. We don’t build voiceprints or any biometric profile of you or your callers.

You and the teammates you invite. Your account has an admin and team members, and the admin can remove a team member at any time; their access ends immediately.

Our team opens your calls only to help you: when you ask for support, or to fix how your receptionist handles your calls. Beyond that, only when security or the law requires it. Everyone at NextPhone who can access your calls has signed a confidentiality agreement.

Recordings, transcripts and summaries stay in your account while it is active, so your call history is always there. Ask us to delete one call or everything, and we delete it and confirm in writing when it is done. If you delete your account, we delete everything from our active systems within 30 days.

On a call, your receptionist only has your business information and notes from earlier calls made from the same phone number. It never has another caller’s details, so it can’t share them.

Only what you turn on: booking into your calendar, texting the caller, transferring to the numbers you choose and updating your CRM. Calls are recorded, transcribed and summarized, so you can see what it did. You can disconnect a calendar or CRM at any time.

Calls are recorded so you get the recording and transcript. Many states, including California and Florida, require everyone on the call to consent. Add a notice such as “This call is recorded” to your greeting, and your receptionist says it at the start of every call. You are responsible for the recording and notice laws that apply to you and your callers; this is not legal advice.

• Encrypted in transit and at rest.
• Calls run on servers in the United States, and your call data is stored there.
• Sign in with Google, or with a one-time code sent by email.
• The logins for your CRM and calendar connections are never sent to your browser.
• Every message from our phone and payment providers is verified before we act on it.
• Texts go out from a carrier-registered business number, and a caller who replies STOP stops getting texts automatically.

SOC 2 is an independent audit, not a certificate. We haven’t completed one yet, but we run NextPhone around the same areas it checks: encryption, tight control over who can access customer data, code review before changes ship, round-the-clock error and uptime monitoring, and a set process for incidents. The infrastructure under NextPhone, our cloud, database and phone providers, is SOC 2 Type II audited. Need a security questionnaire filled out? We’ll answer it.

NextPhone does not take payments over the phone, and your receptionist does not ask callers for card or bank numbers. If one gets recorded anyway, tell us and we delete that recording.

We do not sign BAAs, and our Terms of Service do not allow NextPhone to be used for protected health information.

If an incident ever affects your data, we tell you within 72 hours of discovering it.

Found a security issue, or need a questionnaire filled out? Email security@getnextphone.com.

Each type of provider below is limited to what it needs to do its job. Integrations you connect yourself, like your CRM or calendar, receive what you choose to send them.