Security and privacy

• Sign-in: Google sign-in on the phone and the web, handoff links between them, SSO and domain claims for teams.
• Tenancy: everything belongs to a person or a team; one access check gates every resource, and the release gate proves that one user never sees another's projects, runs, knowledge, bots, tools or voice settings.
• Secrets: model keys, speech keys, MCP headers, HTTP-tool headers, cloud credentials and device tokens are encrypted with a master key the API alone holds; they are never returned to the app (you see a hint, not the key).
• Verified callers: the runner, cron and the voice engine use their own secrets, and a call engine on your machine a token that reaches your account's calls only; Stripe, Dodo, Razorpay, GitHub, Twilio and WhatsApp webhooks verify signatures and ignore replays, so a payment can never be credited twice.
• Tool calls from a call: every tool an agent uses on the line runs through the server and the bot's allowlist. Nothing a caller says can reach a tool the bot was not given.
• Knowledge sources: only public http(s) pages; files only from your own upload folder.
• Firestore: the app reads its own data under rules; every write goes through the API.
• Calls: do-not-call list, calling hours, per-list limits, a recording flag per list; voicemail messages are text you set; recordings and transcripts stay in your account.
• Your data is not training data. Machines are single-tenant, and with your own key the model provider never sees Pocket in the middle.

Before every release

One gate runs the same checks every time: types and unit rules offline; then against the live API, every route tried anonymously with every method, internal doors with wrong secrets, forged webhooks, the tenant line, knowledge end to end with real files; then the smoke on real phones. A bug that reaches a call gets its test before its fix.

Found something? Write to the support address on the About page. We answer security reports first.