Security

You are handing us your database and your calls

So here is exactly how that data is separated, protected, and kept out of places it does not belong — including what we have not done. Pyng is operated by SPACEMINE PVT LIMITED.

Tenant isolation on every query

The platform is multi-tenant by construction, not by convention: domain queries for tenant-owned data go through a scoping layer, so a query without a tenant scope is a code-level error rather than a data leak waiting for a bad WHERE clause.

Credentials stay server-side

Provider keys and secrets are read from the server environment through a single validated module. Nothing sensitive is shipped to the browser, and no secret is committed to the repository.

Encryption in transit

All traffic to this site and to the customer platform is HTTPS-only, with HTTP redirected. Stored provider credentials are encrypted at the application layer with a key held only in the server environment.

Numbers masked, transcripts not logged

Phone numbers are masked to the last four digits in operational logs, and conversation transcripts are not written to logs at ordinary logging levels. Debugging should not require reading a customer's calls.

Your data is yours

Contacts, conversations, recordings, and transcripts belong to the brokerage whose account created them. They are not sold, not shared for advertising, and not used to train general-purpose models.

Audit trail on outbound actions

Every outbound call and message carries a record of the compliance decision that allowed it — and the ones that were skipped record why, which is what you need when a complaint has to be answered.

Least-privilege operations

Access to production systems is limited to the people who need it to run the service. Staff tooling is a separate, gated application from the customer platform.

Access control in your account

Role-based access for owners, admins, and agents, so an agent sees what they need without the whole brokerage's pipeline being open to everyone.

AI and your content

What the models do and do not get

The most common question we get, and the one most vendors answer vaguely.

Conversation content goes to AI providers only to perform the processing your account asked for — speech, transcription, summarisation, drafting.
We contract with AI providers on terms that do not permit training their models on your conversation content.
We do not use your conversation content to train models of our own.
Recordings and transcripts are visible inside the owning account only.

Straight answers

The questions a security review asks

Send your questionnaire to gowtham@pynghq.com and we will complete it in writing.

Do you have SOC 2 or ISO 27001?

No — and we are not going to display a badge we have not earned. The controls on this page are the ones actually built into the platform, and we will answer a security questionnaire in writing with specifics. If a formal certification is a hard requirement for your brokerage, tell us and we will be straight with you about timing.

Where is data processed?

The platform serves the United States and Canada and is operated by a company established in India, so processing happens in more than one country, including by our service providers. Cross-border transfers rely on contractual protections with those providers. The categories of provider are listed in the Privacy Policy.

Can we export or delete everything?

Yes. You can export your data while the account is active, and request deletion after termination. Suppression and opt-out records are the deliberate exception — deleting those would erase the very record that stops someone being contacted again.

How do we report a vulnerability?

Email gowtham@pynghq.com with enough detail to reproduce it. We will confirm receipt, keep you updated while we fix it, and we will not pursue anyone who reports in good faith and does not access other customers' data.

What happens in a breach?

No system is perfectly secure. If an incident affects your data we will tell you what happened, what was affected, and what we did — within the timeframes applicable law requires, and without waiting to have a tidy story.