Doorline

Security

We treat trust as the product.

Doorline handles inbound real estate calls, calendar bookings, and a ledger of customer-impacting outcomes. Here's how we keep that data safe.

Authentication & access

  • Customer dashboards use Clerk for authentication with strong defaults (MFA, breached-password detection, social SSO when configured).
  • Every API call from the dashboard is authenticated with a Clerk-signed session JWT, verified against Clerk's JWKS on each request.
  • Service-to-service calls (agent worker → control plane) use a dedicated bearer token validated with constant-time comparison; tokens rotate at every deploy.

Tenant isolation

  • Postgres Row-Level Security (RLS) is enforced on every tenant-scoped table — 18 policies, deny-by-default.
  • The application runtime connects as a role that cannot bypass RLS. Cross-tenant lookups (e.g. resolving a dialed number to a tenant) run on a separate, scope-limited admin connection.
  • RLS violations attempt-counts feed our internal alerting; we audit every attempted cross-tenant read.

Encryption

  • In transit: TLS 1.3 everywhere. HSTS preloaded.
  • At rest: AES-256 on the database disk (Neon / RDS managed). OAuth tokens for third-party calendars and CRMs are additionally encrypted with Fernet (AES-128-CBC + HMAC-SHA256) at the column level.
  • Secrets are managed in Doppler with per-environment scopes; nothing sensitive lives in source.

Call recordings & PII

  • Recording disclosure is auto-injected when either party is in a two-party-consent state.
  • Recordings are stored on Cloudflare R2 with default 30-day retention; brokerages can configure shorter windows.
  • PII (names, phone numbers, emails) is column-encrypted in transcripts; full transcripts are decrypted only when an authorized user views them.

Outbound calling compliance

  • Every outbound dial passes a National DNC scrub before it leaves Doorline; the dialer refuses to dial without it.
  • TCPA consent is required and verified per-lead: source, verbatim consent text, IP, and timestamp are stored and re-checked at dial time.
  • STIR/SHAKEN A-attestation is handled by our telephony provider on every outbound call.

Audits & compliance

  • Every privileged action (tenant onboarding, integration connect, dispute opened, refund issued) writes an immutable row to an append-only audit log.
  • SOC 2 Type II audit is in flight with a Big-Four-affiliated assessor. DPA available on request for Brokerage-tier customers.
  • Annual third-party penetration test; the most recent report is available under NDA.

Observability & incident response

  • Errors and traces flow into Sentry with tenant + request correlation tags; on-call rotates 24/7.
  • Status page at status.doorline.ai posts within 15 minutes of any incident affecting ≥ 5% of traffic.
  • Post-incident reviews are published to customers within 5 business days for any P0/P1 incident.

Subprocessors

  • Full vendor list (data flows + DPA links) lives at /legal/dpa. We post 30-day notice before adding a new subprocessor.
  • Primary subprocessors: AWS (compute, storage), Stripe (billing), Anthropic (LLM), Deepgram (STT), Cartesia (TTS), LiveKit (voice transport), Twilio (telephony), Clerk (auth), Neon (Postgres), Cloudflare (CDN + recordings storage).

Security questions or vulnerability reports?

Email security@doorline.ai. PGP key on our security.txt at /.well-known/security.txt.