How Oncallz protects your data

How is one organization’s data kept apart from another’s?

Every organization is a separate tenant, and every tenant-owned record carries a tenant ID. A global query scope constrains each database query on those records to the signed-in user’s tenant, so isolation is enforced in one place instead of being repeated in every screen.

The current tenant is derived from the authenticated user, never from a header, subdomain or form field the browser could change. It is set before route-model binding runs, so a record ID that belongs to another organization returns “not found” instead of loading.

How are provider credentials stored?

The credentials you enter for your own Twilio or Vonage account and your AI provider API key are encrypted at rest with the application’s encryption key. They are used only to send your organization’s messages and calls, or to run AI investigations you have enabled.

Passwords are never stored in plain text. They are hashed with bcrypt, and the same applies to the optional password on a public status board.

How is signing in protected?

Account access has several layers of protection:

• New accounts must verify their email address before using the app.
• Sign-in, registration, invitation and password-reset endpoints are rate-limited per IP address to slow down credential guessing. Phone-verification and status-board unlock attempts have their own, tighter limits.
• The password-reset form gives the same response whether or not an address exists, so it cannot be used to discover accounts.
• Completing a password reset signs the account out everywhere else: other browser sessions and all issued API tokens are revoked, and the user is notified of the change.
• Phone numbers are verified with a one-time code before any SMS or voice page is sent to them.

How do API tokens and the mobile app authenticate?

The mobile app uses short-lived access tokens and separate refresh tokens. Each has its own ability: a refresh token can only be exchanged for a new pair and cannot call the API. Tokens are issued in families, so signing out on one device revokes that device’s pair without affecting others.

Personal API tokens for the REST API are shown in full only once, when created, and can be revoked at any time from your profile. All tokens are revocable server-side.

What can administrators see and control?

Organization administrators have these controls:

• An audit log records who changed configuration such as teams, schedules, overrides, escalation policies, integrations, messaging providers, AI settings, maintenance windows, call-suppression rules, outbound webhooks and users.
• Deactivating a user immediately revokes their API tokens and ends their web session on the next request. The account is kept so it can be reactivated later.
• Administrators can remove a user’s registered push devices.
• Integrations receive alerts through per-integration routing keys, and inbound events are rate-limited per key so a leaked or flapping source cannot flood your incidents.

Can users delete their own data?

Yes. Any user can delete their own account from the mobile app or the web profile page without contacting us. Deletion from live systems is immediate. The data deletion page lists exactly what is removed and what stays with the organization.

Where does Oncallz run?

The application servers are hosted by Hetzner Online GmbH in Germany. All traffic to oncallz.com goes through Cloudflare, which terminates HTTPS (TLS) in front of the application.