Security

Every record in Handly — calls, jobs, customers, messages, review requests — is tagged with the account that owns it, and that ownership is enforced by the database itself rather than by the app screens. A request for another tradesperson's customer list is refused at the data layer, not just hidden in the interface.

Traffic to and from Handly is encrypted with TLS. Data at rest, including call recordings and transcripts, is encrypted by our hosting provider.

Telephony, AI and billing credentials are held server-side and used only inside our backend functions. They are never included in the app you load, and they are never returned by an API response.

Events that arrive from outside — incoming calls, SMS, Stripe billing events — are verified against the provider's signature or a shared secret before we act on them. An unsigned request that claims to be Twilio or Stripe is rejected.

Only a small number of Handly staff can reach production data, access is tied to named accounts with multi-factor authentication, and it is used for support and incident response only.

Card details are collected and stored by Stripe, a PCI-DSS Level 1 provider. Handly stores a customer reference and subscription status — never a card number.

We rely on Twilio, Vapi, OpenAI, Deepgram, ElevenLabs, Stripe, Base44, and Google or Microsoft where you connect a calendar. Each receives only the data needed to perform its function.

If you believe you have found a security issue, email security@wearehandly.com with enough detail to reproduce it. We will acknowledge within two business days, we will not pursue researchers acting in good faith, and we will tell you when the issue is fixed.