Controls that keep your calls on the right side of the rules

Agents tell people they are talking to an automated assistant. The disclosure is on by default for outbound calls and the starter templates open by identifying an automated assistant.

If someone asks whether they are speaking to a person, the agent answers plainly that it is an AI. Only a workspace owner or admin can change the disclosure setting, and where the law or a platform requires disclosure it is your responsibility to leave it on.

Contacts carry a consent record that you maintain. Where a country requires consent for automated calls, campaigns in that country only call contacts with consent on record.

You are the party that decides who may be called. Upload only people who enquired, are existing customers, or agreed to hear from you, and keep your own evidence of that.

Numbers on the national do-not-call registry and on your workspace’s own do-not-call list are blocked before dialling. For India this protection cannot be switched off.

Calls follow the legal calling hours of the destination, based on the contact’s local time. For India that is 9:00 to 21:00. A campaign window can narrow these hours but never widen them. Calls that fall outside are held and tried in the next window.

Call recordings are on by default and kept for 90 days. The agent announces recording in the opening of every call. Transcripts, summaries and extracted fields stay with the call in your workspace.

Your data is scoped to your workspace. You can export your contacts, and you can ask for your data to be deleted (see the data deletion page). DialBots staff can open a workspace only in a read-only view, and every such session is recorded in that workspace’s audit log.

Four roles (owner, admin, member and viewer) decide who can edit agents, run campaigns, spend from the wallet, create API keys and manage the team.

API keys are shown once, carry only the scopes you give them, record when they were last used and can be revoked at any time. Passwords are stored as salted hashes. Secrets you add to custom tools, such as an authorization header, are stored encrypted and are never shown again in full.

Every webhook is signed with HMAC-SHA256 over the raw body and a timestamp, with a 5 minute tolerance against replay. Endpoints must be public HTTPS addresses; private and loopback addresses are refused and redirects are not followed.