Security at GC Front Office

GC Front Office is a product of GoThriveAI, LLC. Grace, our AI-powered virtual assistant, answers your company's phone, so we handle your callers' names, numbers, and messages. This page explains, in plain words, how we protect that information.

Where a term is technical, we add it in parentheses or in a short "For the technical reader" line. No online service is risk-free, so we also say what we don't have.

Who can see your calls

Each company sees only its own call records, contacts, and projects in the app. The database itself enforces this, so the separation does not depend only on what the screens show.
Your team signs in with an email and password. There is no public sign-up, and GoThriveAI creates the accounts.
The public internet has no direct access to our data tables.
Within your company, everyone with a login sees all of your company's calls, transcripts, and summaries.
The primary person at a company, usually the owner, can change company settings. Other logins cannot.
A small number of GoThriveAI administrators can see data across companies, to set up and support the service. Their changes to company settings are written to a log. No signed-in user, administrators included, has permission to edit or delete past log entries.
We test this separation ourselves. Our tests run inside the database and try to read and change another company's data. In our most recent tests, the database blocked those attempts. These are our own tests, not an outside audit.

For the technical reader: Postgres row-level security (RLS) is on for the calls, contacts, and projects tables, with separate policies for select, insert, update, and delete. Each policy filters on tenant_id = my_tenant_id(), and that function looks up the signed-in user's company from the tenant_members table, never from anything the browser sends. Policies apply to the authenticated role, and the public tables have no anon or PUBLIC grants. Supabase Auth uses the email provider only, with sign-up disabled and anonymous users disabled. Admin access runs through is_admin(), and admin-only functions are SECURITY DEFINER with a pinned search_path. Our isolation checks run as rolled-back test scripts inside the database.

How your data is protected

The GC Front Office app, where your team views calls, uses a secure connection (HTTPS with TLS, the padlock in your browser), and it tells your browser to always use that secure connection.
The link that carries call details from our voice provider to our app also uses a secure connection (HTTPS).
Our database provider and our scheduling provider each state that they encrypt stored data (encryption at rest), which scrambles it so it is unreadable without a key.
Passwords and access keys that our software uses are kept in a protected store on our servers, not in the website's code.
The keys we hold to connect each company to our scheduling provider are stored encrypted on the server.
When our voice provider sends us a finished-call record, our app checks its digital signature and refuses records without a valid one.

For the technical reader: The app negotiates TLS 1.3 (TLS_AES_256_GCM_SHA384), accepts TLS 1.2, and refuses TLS 1.0 and 1.1. It sends the HTTP Strict Transport Security (HSTS) header strict-transport-security: max-age=31536000; includeSubDomains (one year), along with x-content-type-options: nosniff and a strict-origin-when-cross-origin referrer policy. Our hosting platform sets those headers. The finished-call webhook (retell-webhook) verifies an HMAC-SHA256 signature over the request body and timestamp and returns 401 for a bad signature. Secrets live in the platform's secret store, and the browser holds only the public database key, which row-level security restricts. Scheduling keys sit in an encrypted key store with a key_version, and the key-encryption key is a server-side secret. Our database provider documents AES-256 at rest and TLS in transit, and our scheduling provider states that it encrypts scheduling data in transit and at rest.

Who runs the service

These are the main providers that run the service.

Our app runs on Lovable Cloud, which is built on Supabase (a database and sign-in service), and it is served through Cloudflare (a service that sits in front of the website to protect it and make it faster).
Our database provider, Supabase, states that it runs on Amazon Web Services (AWS), a large cloud-hosting company.
Phone calls and Grace's voice run on Retell AI.
Booking runs through our scheduling provider.
Our providers state that they hold their own security reports. Our platform provider states SOC 2 Type II and ISO 27001:2022. Our voice provider states SOC 2 Type 1 and Type 2. Our scheduling provider states SOC 2 Type II. SOC 2 is an independent audit of a company's security practices, and ISO 27001 is an international security standard. These are our providers' reports, and they cover each provider's own service, not GC Front Office.
Our voice provider states that it has zero-data-retention agreements with the AI and speech services it uses. That statement is about those services only. Our voice provider itself keeps call recordings and transcripts.

For the technical reader: Hosting is a Lovable Cloud project (Supabase Postgres and Auth; Supabase states it runs on AWS) behind Cloudflare. Voice runs on Retell AI. Provider reports are the providers' own, and we have not independently verified them.

Call recordings and transcripts

Calls are recorded, and callers are told at the start. Grace's opening greeting includes a recording notice and says that she is a virtual assistant, and our database refuses a greeting edit that removes that wording.
Transcripts and summaries are visible to the signed-in people at your company and to a small number of GoThriveAI administrators.
Our voice provider itself keeps call recordings and transcripts until they are deleted.
In the app, you can delete your company's contact records. Deleting call records and project records is not available in the app yet. Deleting a record in the app removes it from our database, and it does not by itself remove a copy held by our voice provider.
For questions about your records or to make a data request, email admin@gothriveai.com.

For the technical reader: Row-level security includes a DELETE policy scoped to the company's tenant_id. The greeting check is a database function (gc_greeting_ok).

Card details

The app has no payment form today, and we do not collect or store card numbers on purpose.

Your control

We do not sell personal information. We do not share mobile phone numbers with third parties or affiliates for marketing or promotional purposes.
Questions and data requests go to admin@gothriveai.com.
You can read more in our Privacy Policy.

What we don't have

GC Front Office does not currently hold a SOC 2 report or HIPAA attestation.
SOC 2 is an independent audit of a company's security practices, and HIPAA is the U.S. law for health information.
Several of our infrastructure providers state that they hold their own SOC 2 reports. These reports cover each provider's own service, not GC Front Office.
GC Front Office is not designed for medical records or health information, and we have no HIPAA Business Associate Agreements (the contracts that law calls for when a vendor handles health information).
We do not claim a provider's report as our own.
We do not yet have an independent security audit or penetration test (a test in which outside experts look for weak points).
Sign-in uses an email and password only. Two-step sign-in (multi-factor authentication) is not turned on yet.

For the technical reader: SOC 2 is an audit report on a company's security controls. HIPAA is a U.S. health-privacy law, and a Business Associate Agreement (BAA) is the contract it calls for when a vendor handles protected health information.

Report a security concern

To report a security concern, email admin@gothriveai.com. Tell us what you saw and where you saw it.