Protect live call operations from workspace access to provider callbacks.
Sauti combines tenant-scoped data access, encrypted integration credentials, authenticated public events, explicit call controls, and durable operational records.
Tenant isolation is part of every customer data query.
Authenticated services resolve the current workspace and repositories scope customer records by tenant before returning or changing data.
- Agents, calls, bookings, analytics, and integrations are tenant-scoped
- Role and workspace context are enforced at service boundaries
- API responses expose authorized metadata, never another tenant’s records
Provider credentials stay encrypted and server-side.
Integration secrets and OAuth tokens are encrypted at rest. Customer-facing APIs return connection status and safe metadata rather than secret values.
- Encryption happens before persistence
- Secrets are excluded from logs and API responses
- Connections are workspace-scoped and agent enablement remains explicit
Signed events are verified before business logic runs.
Telephony, billing, and managed tool callbacks use provider signatures or a dedicated server-only secret, with bounded and idempotent processing where retries are expected.
- Reject invalid or missing authentication
- Acknowledge provider timing requirements safely
- Make post-call and external delivery retries idempotent
Consent, retention, and action policies remain explicit.
Recording behavior follows workspace consent settings, while agent tools and payment-related actions use narrowly defined authorization and confirmation rules.
- Do not record without the configured consent path
- Require confirmation for consequential actions
- Keep test calls marked as tests in operational data