Security & trust
How CallHeim protects your incident operations.
Tenant isolation, roles and permissions, encryption in transit and at rest, an append-only audit trail with a retention-locked archive, and point-in-time recovery — the controls behind every incident your team runs through CallHeim.
- Tenant A4 rows
- Tenant B3 rows
- Tenant C5 rows
Example: a read from Tenant B
Returns Tenant B’s three rows. Reads are scoped to the caller’s tenant on 61 data models by the API authorization rule; 97 custom operations scope the tenant in server-side code instead.
Identity & access
Who gets in, and what they can do.
Assignment
Your tenant and role are assigned server-side and stamped on your token; users cannot edit them.
Sign-in and two-factor
E-mail and password sign-in with optional authenticator-app (TOTP) two-factor authentication.
Roles and permissions
Five built-in roles with 22 permissions, plus per-workspace permission overrides and custom roles.
Provider integration secrets — API keys, webhook signing secrets — are stored in AWS Secrets Manager. Once entered, they are write-only: the console never shows them back.
Encryption
How data is protected in transit and at rest.
The console
The console is served over HTTPS (TLS 1.2 and 1.3 are accepted) with HTTP redirected to HTTPS, HSTS with a two-year max-age, nosniff, clickjacking and referrer protections.
Data at rest and in transit
Data is encrypted at rest with AWS encryption (DynamoDB, S3 and SQS) and in transit with TLS.
Storage
CallHeim’s S3 buckets block public access and are encrypted at rest.
Data protection & recovery
Backups and point-in-time recovery, built in.
Point-in-time recovery (35-day window) and deletion protection are enabled on CallHeim’s production data tables.
A daily managed backup with 35-day retention covers eight core tenant tables (incident, alert, tenant, user, schedule, escalation policy, audit log and de-duplication keys), in an AWS Backup vault in the same account and region. Daily per-workspace configuration snapshots (users, teams, schedules, escalation policies, integrations) are kept for CallHeim-assisted recovery.
Release safeguards
What has to pass before a change reaches production.
Every tenant release runs automated tests, a type-check, lint, a secret scan and a dependency audit that blocks on critical findings before it deploys, and a failing step stops the deploy.
Reliability
How alerts are buffered, and where CallHeim runs.
- Inbound alerts are queued durably (SQS with a dead-letter queue and depth alarms) so a spike is buffered; the queue keeps messages for four days.
- CallHeim runs on AWS, in the us-east-1 region.
Where your data goes
Every recipient of page content and platform data.
Application data is stored in AWS us-east-1. Page e-mail is sent through Resend and contains the recipient address, the incident title and alert text and an acknowledge link. Phone-number verification codes are sent through Twilio, and if a responder enables SMS or voice notifications, those messages, which carry the incident title and alert text, also pass through Twilio. The sign-in page at app.callheim.com loads its fonts from Google Fonts. No incident data is sent to an external language model.
Compliance
Compliance status.
CallHeim does not currently hold SOC 2, ISO 27001 or other third-party security certifications.
Built to be checked, not just claimed.
CallHeim helps teams stay in control when critical systems are not. Explore the platform, connect one source, and send yourself a page.
Early access · every workspace starts with a 14-day trial for up to 5 seats, no card required