Trust & Compliance

• Consent before every call. A call is placed only to a number your Organization has recorded consent for, with its basis, and only while that consent stands. Revoking it stops further calls.
• Calling hours. Calls are placed only between 8 am and 9 pm in the time zone of the person being called. Their zone comes from their CRM record, a zone you state, the number’s own country or area code, or a fallback zone you chose for the campaign; with none of these, the call is not placed. A campaign can narrow these hours, never widen them.
• Recording disclosure. A call is recorded only when its assistant has a recording disclosure, and the disclosure is the first thing said. An assistant without one never records.
• Your do-not-call list. Numbers on your Organization’s suppression and do-not-call list are never called. National registers (such as the US National Do Not Call Registry or the UK’s TPS) are not screened.
• Every check recorded. Each check, passed or refused, is written to your Organization’s audit log.

• Append-only. The audit log cannot be edited or deleted: the database refuses changes, deletions and truncation of its entries. The one change made to an entry is removing personal details when a person’s data is erased, and that change is recorded too. You can read it under Security & Audit in your workspace.
• Staff sessions recorded. When an Outtricks staff member views the platform as your Organization, every request made in that session is written to your audit log, with the method and route. If that entry cannot be written, the request is refused.

• Access. Export everything held about yourself from Settings, Privacy & Data, or about a Contact from that Contact’s record. The file can be downloaded only by the person who asked for it, for seven days.
• Erasure. Erase a person across every module with “Erase personal data”. What has to be kept, such as ledger entries, is anonymised, and a one-way suppression entry stops the person being contacted or imported again.
• Account and Organization deletion. Delete your own account, or, as an Owner, the whole Organization, from Settings, Privacy & Data, after confirming who you are and following an emailed link.
• People in the Lead Database. Anyone can ask to be suppressed platform-wide; see the Lead Database notice.

• Two-factor authentication. Any user can turn on two-factor sign-in with an authenticator app, in Settings, Security. Its secrets are encrypted at rest with AES-256-GCM; one set up before that encryption was introduced is encrypted the next time it is used to sign in.
• Support links stored as hashes. The private link that lets someone follow a support ticket is stored only as a SHA-256 hash. A ticket opened before hashing was introduced keeps its link in plain form until the link is next opened, when it is replaced by its hash.
• Role-based access. Every member has a role, and actions are checked against that role’s permissions. Custom roles can be created with exactly the permissions you choose.

For how data is protected, and what is not in place yet (Outtricks has no SOC 2 report or ISO 27001 certificate), see our Security page. Our Data Processing Agreement lists the sub-processors, and our Acceptable Use Policy sets the rules for outreach.