Skip to content

Where your data goes, and who can reach it.

You are about to upload a lead list and record your calls. This page says where each of those ends up, in plain words, including the parts we have not done yet.

Last checked November 13, 2026

Follow the data

  1. Your lead list

    Our database, hosted by Supabase

    Row-level security keeps each business’s rows apart. A rep sees their own team’s leads and nobody else’s.

  2. The call itself

    Telnyx, the carrier, for the length of the call

    Audio between the browser and the call travels encrypted. Telnyx holds the phone numbers assigned to your business.

  3. Recordings

    A private storage bucket

    A recording plays through a short-lived link, only for the signed-in user who placed the call.

  4. Transcripts and AI notes

    Our database

    Audio goes to a transcription provider and the text to an AI model. We do not use your call content to train models.

  5. Your card

    Stripe

    The card number never reaches our servers. We keep the brand, the last four digits and what the bank told Stripe about it.

  6. Your business’s tax ID

    Our database, encrypted

    Encrypted with AES-256. Only the last four digits stay readable.

Every company in that list, and what it handles, is on the sub-processors page.

What we do

Encrypted in transit

Every page, API call and webhook runs over TLS.

Sensitive values encrypted at rest

Tax IDs and mailbox passwords are encrypted with AES-256 before they are stored.

One business cannot read another

Row-level security is on for every table, so the database itself refuses a query for someone else’s rows.

Every business is checked

Company details, a phone confirmed by code, the calling rules and a card, before the first call goes out.

No ad trackers

The site and the app run no advertising cookies or ad pixels. Page visits are counted by Vercel Web Analytics.

Kept apart from DialSheet

Five at a Time's customers and calls sit in their own database, separate from our other product.

How long we keep it

30

days after an account closes, its leads, call records, recordings and AI notes are deleted from our live systems.

30

days after closing in which you can ask for a copy of your leads and call records.

1

year, at most, for logs and verification records kept for audit and fraud prevention. Billing records are kept as long as tax law requires.

What we have not done yet

A security page that lists only strengths is an advert. These are the gaps, so your review does not have to find them.

  • No SOC 2 report or other third-party security audit yet.
  • No single sign-on (SAML) or enforced two-factor sign-in.
  • No published uptime commitment or status page.

Report a security problem

Email abhi@paperkites.co with what you found and how to reproduce it. Please do not test against other customers’ data or place calls to do it. We will reply, fix what is real, and tell you when it is fixed.

The terms for data we process for your business are in the Data Processing Addendum. The rest of the legal detail is in the Privacy Policy (sections 3, 7 and 8) and the Terms of Service.