What needs protecting
Your account and business conversations
PingMate handles account details, business settings, customer phone numbers, messages, call records, voicemail recordings and transcripts. Protecting that information depends on controls inside PingMate and the providers that deliver phone, AI and payment services.
Section 1
Safeguards in the service
These are the main protections implemented in the current PingMate application. They are described by what they do, without certification language or guarantees the service cannot support.
Account access
Passwords are stored as one-way hashes. Password changes require the current password, while changed and reset passwords must meet PingMate's strength rules.
Login and password reset requests are rate limited. Successful login also starts a fresh session identifier.
Request protection
Browser requests that change data use cross-site request forgery protection. Sensitive actions have additional request limits to reduce repeated or automated attempts.
Session cookies are configured for HTTPS, blocked from JavaScript access and use SameSite safeguards.
Account boundaries
The dashboard, messages, missed calls, settings and billing pages require an authenticated account. Customer records are loaded through that account or checked against its owner.
Administrative pages require a separate authorisation check.
Service connections
Incoming Twilio callbacks must carry a valid Twilio signature. Invalid or missing signatures are rejected before call or message data is processed.
PingMate also sends browser security headers that prevent framing and content-type guessing.
Section 2
Password and session practices
PingMate does not store readable account passwords. Password changes and resets require at least 12 characters, mixed upper and lower case letters and a number. Proposed passwords are also checked against known compromised passwords.
- Password reset links expire after 60 minutes and repeat requests are limited.
- A successful sign-in regenerates the browser session identifier.
- Changing a password from settings requires the current password first.
Your part matters too
Use a password you do not use elsewhere, keep sign-in details private and sign out before leaving a shared device. Contact PingMate promptly if account activity looks unfamiliar.
Section 3
Providers involved in the service
PingMate relies on established providers for telecommunications, selected AI functions and payments. That means relevant information is processed outside the PingMate application when those services are used.
Twilio
Provides the PingMate number and carries calls, SMS messages, recordings and related service callbacks.
OpenAI
Processes relevant message or voicemail content for enabled features such as generated replies, classification, summaries and transcription.
Stripe
Hosts checkout and the billing portal, and processes subscription payments. Card details are entered on Stripe-hosted pages.
The Privacy Policy explains what information PingMate collects, why it is used and when it may be shared.
Section 4
The limits of this page
Security controls reduce risk, but no online service can guarantee absolute security. This page is not a claim of independent certification, a completed security audit or protection against every possible threat.
If your business has specific procurement, regulatory or data-handling requirements, contact PingMate before subscribing. We will answer based on the service as it operates, rather than make a broad assurance.
Section 5
Report a security concern
If you believe you have found a vulnerability, exposed information or suspicious account behaviour, please report it privately. Include the affected page or feature, what you observed and a safe way for us to reproduce it. Do not access another person's data or disrupt the service while investigating.
Security contact
Use the subject “Security report” so the concern is easy to identify.