Security
keys, tools, console, portal.

01Console

• No account can be created without the one-time setup code printed in the server log.
• Admin Kit sessions (HttpOnly, SameSite=Strict); every console route needs a signed-in session; product pages check the role (viewer reads, manager changes, owner manages keys and team).
• Every state-changing request needs a custom header and a same-origin Origin; every change is written to the audit log, as are opening a transcript, playing a recording and exporting callers or calls.
• Two-factor authentication per account, and a team rule to require it (Security & alerts).

02Keys and per-client secrets

Keys saved in the console are encrypted with ADMIN_SECRET_KEY (AES-256-GCM) and write-only: they can be replaced or tested, never read back. A key set in .env locks its console field. No key or secret is written to the log. Calendar refresh tokens are sealed with AES-256-GCM under a key derived from ADMIN_SECRET_KEY. What happens when the key is lost or rotated: ADMIN_SECRET_KEY.

03Tool requests

ElevenLabs webhook tools are not signed; the platform sends a header with each request. So each client has its own secret in the x-answerbell-tool-secret header, derived from ADMIN_SECRET_KEY (HKDF, then HMAC-SHA256 of the client id and a version), compared in constant time. Nothing is stored; Rotate tool secret changes it. A leaked secret works for one client only.

• Rate limits per address and per client (the per-client limit counts only after the secret is checked).
• Request bodies are capped (16 KB for tools).
• Client text (FAQ, services, documents) reaches the agent as quoted data, not as instructions; the business name and the receptionist's name are limited to plain characters.
• caller_history answers only for the number the call comes from, never for a number the caller says, and never includes your team notes.

04Requests to addresses typed in the console

Webhooks, iCal feeds and Fill from the website: https only; the host is resolved and every address must be public (no loopback, private, link-local, CGNAT or metadata ranges); the check happens inside the connection itself, so DNS rebinding cannot swap the address; redirects are checked hop by hop (webhooks follow none); bodies are capped.

05Incoming provider webhooks

Stripe (Stripe-Signature, HMAC-SHA256, five-minute window; events stored by id so a repeat changes nothing), Meta (X-Hub-Signature-256) and Telnyx (Ed25519, five-minute window) for the Follow-up add-on. Unsigned requests are refused. Your own outgoing webhooks are signed with x-answerbell-signature (Webhooks).

06Web pages and the portal

A strict Content-Security-Policy on the product pages and the portal (script-src 'self', style-src 'self', no inline styles or scripts). Portal sign-in links are single-use and valid for 20 minutes; the login page answers the same for known and unknown addresses.

07Personal data

Callers' numbers are masked for viewers and in the portal; transcripts and recordings stay in ElevenLabs and are fetched per view (audited). Recordings are streamed, never written to disk. CSV exports neutralise spreadsheet formulas.

08Your part

• HTTPS in front of the server (Deployment).
• Back up data/ and ADMIN_SECRET_KEY.
• Give team members the lowest role they need.
• Keep DEMO_MODE off on your real server.
• Allow portal recordings only when your contract with the business covers it.