When you hand a business over to a platform, you're trusting it with your customer list, your call history, and your revenue. Here's a plain-English account of how that information is handled.
No security theatre and no badges we haven't earned. Where a protection comes from one of our providers rather than from us, we say so.
Every site we build is served over HTTPS, so traffic between your customers and your website — including anything typed into a booking or contact form — is encrypted in transit using industry-standard TLS. This is enforced by our hosting and CDN providers and is straightforward to verify: look for the padlock in your browser.
Storage is handled by established hosting, database and payment platforms rather than infrastructure we run ourselves. Their own security documentation describes what they do with data at rest; we'd rather point you at their published terms than restate protections we don't operate.
Card payments — yours and your customers' — are handled entirely by PCI-compliant third-party payment processors. Card details go directly to the processor.
We do not store full card numbers, CVV codes, or bank credentials anywhere in our systems. What we can see is limited to what the processor exposes for reconciliation: things like the last four digits, card brand, amount and status.
To be precise about who is certified: the processor holds PCI DSS compliance. We are not making a claim about certification of our own infrastructure.
The AI receptionist processes calls to understand what a caller wants, book appointments and write call summaries. Depending on your configuration this may involve recordings, transcripts, or both.
Call recording law differs by province and state, and complying with it is a decision we make together during onboarding, not something we can promise in advance. We will tell you what your configuration records, and you decide what is captured. Where your jurisdiction requires notice or consent, you should take your own legal advice on what that requires — we are not in a position to certify compliance on your behalf.
Because this is a done-for-you service, our team does hold access to the systems running your business — that's how we build your site and configure your receptionist. We keep that access as narrow as the work allows.
We're a small team and we haven't yet formalised these into an audited access-control policy with documented reviews and offboarding procedures. If your business needs that level of assurance in writing, ask us before signing up rather than assuming it.
We don't build every layer ourselves. Hosting, telephony, payments, email and advertising all run on established platforms, chosen partly because their security resources far exceed what a company our size could build alone.
Those providers process data on our behalf under their own terms and security programs. The table below sets out the categories involved and what each one touches.
Your domain, your website content, your customer records and your reviews belong to your business. We don't sell client or customer data, and we don't share it with anyone beyond the providers needed to run your service.
Plenty of companies our size decorate a page like this with compliance logos. We'd rather be straight with you: FrontDesk Launch does not currently hold SOC 2, ISO 27001, HIPAA or any other formal security certification, and we haven't undergone an independent compliance audit or penetration test.
We also don't claim encryption at rest as our own control — the platforms we build on provide it, and you should read their terms rather than ours for that. We don't have a formal, documented access-control and offboarding policy. And we can't certify that your call recording setup complies with the law where you operate; that's a conversation we have with you, not a guarantee we can make on a web page.
What we've described above is what we actually do. If your business operates under a regulatory regime with specific requirements — healthcare records, for instance — talk to us before signing up so we can be clear about whether we're a fit, rather than discovering it later.
These are the categories of third parties that may process data as part of running your platform. We'll name the specific providers used for your setup on request.
| Category | What it handles |
|---|---|
| Website hosting | Serving your website and storing its content, images and video |
| Telephony & AI voice | Carrying calls to your AI receptionist, and generating transcripts and summaries |
| Payment processing | Card and online payments. Card data goes to the processor directly, never to us |
| Email & SMS delivery | Sending appointment reminders, follow-ups and review requests |
| Scheduling & calendar | Storing and syncing your appointments |
| Analytics | Website traffic figures used to build your monthly report |
| Advertising platforms | Running and measuring campaigns where marketing is part of your package |
If you believe you've found a vulnerability in our platform or in a website we built, please report it to us directly rather than disclosing it publicly. We read every report and we won't pursue action against anyone who reports a genuine issue in good faith.
✉ [email protected]Helpful things to include: what you found, the URL or phone number involved, the steps to reproduce it, and how you came across it. We'll acknowledge your report and keep you posted on what we do about it. For anything that isn't a security issue, the contact page is the faster route.
This page describes our practices in general terms and is not a contract. Specific commitments for your business are set out in your service agreement. Last reviewed: 28 July 2026.