Your API keys
- Keys are stored hashed. The full key is shown only once, when you create it.
- Keep keys on your server. Your users’ browsers only play the avatar’s stream; they never need a key.
- You’re responsible for all usage on your keys. If a key may have been exposed, revoke it straight away.
Audio and video
Voice agent requests
Every tool request and post-call webhook is signed with the agent’s own secret, using Standard Webhooks, so your server can check it came from your agent. See Verify signatures. Voice agent call pages, including embeds on your site, don’t run analytics, session recording or support chat for your callers.Payments
Payments are processed by Dodo Payments. Your card details go directly to them; we never see or store your full card number.Your responsibilities
- Tell your users they’re talking to an AI where the law requires it, and whenever they might otherwise be misled.
- Have a lawful basis, and give any required notice, for personal information your users share with your agents.
- Only send audio you have the rights to use, and only create custom avatars of people who have consented.