Security & trust
Where your data lives, and how we look after it.
“Canadian data · CASL-compliant” is easy to put on a badge. Here's what it actually means in this product — in plain language, with nothing on this page we can't back up.
A Canadian company, under Canadian law
TwoRing is operated by Bilco Works Inc. in Calgary, Alberta. We handle personal information under Canada's PIPEDA and Alberta's PIPA — not a foreign framework you'd have to go looking for.
Your data lives in Canada
Your business records — calls, transcripts, leads, bookings, and messages — are stored on servers located in Canada. A small number of service providers process data to make the service work (telephony and SMS, the AI voice platform, email delivery, and payments); each one is named in our privacy policy.
CASL is built in, not bolted on
Texts go only to people who contacted your business first. Every automated reply identifies your business and carries opt-out instructions, and a STOP (or UNSUBSCRIBE, CANCEL, END, QUIT) reply is honoured automatically — the system stops texting that person immediately, and START opts them back in.
Account security that actually revokes
Access is role-based — owners, admins, and members see and change only what their role allows. When a password changes or a teammate is removed or demoted, their existing sessions are revoked immediately, not at some future expiry. Every record is scoped to your business; one customer can never see another's data.
Platform hardening
Everything runs over TLS with HSTS and modern browser security headers. Credentials for connected calendars are encrypted at rest. Outbound webhooks are signed (HMAC-SHA256) so the tools you connect can verify every event really came from us.
Your data is yours
Export your calls, leads, and appointments as CSV or JSON from the portal any time — no request form, no waiting. You can also ask us to correct or delete your information; the privacy policy explains how.
Found something?
If you spot a security issue, email [email protected] — it goes straight to the founder and gets looked at fast.
The full details live in the privacy policy and terms of service.