Security FAQ

Two ways, your choice. Self-hosted: the voice gateway runs on your own server next to your OpenClaw agent, so your agent's brain, memory, tools, and CRM data never leave your machine. Managed: we run the gateway for you on a dedicated host in our fleet.

In both modes the same parties touch a live call, and only these: our telephony carrier connects the call, a Cloudflare tunnel carries it to the gateway, and Google's Gemini Live model does the listening and speaking. When a caller asks something that needs your agent, the gateway asks your OpenClaw agent over loopback, and that agent uses whichever LLM vendor you configured for it.

Your server: no. On a self-hosted deployment we have no login, no SSH key, and no way to run code on your machine. The gateway reports outward to us (heartbeats and call events); nothing comes inward except signed carrier webhooks. Live audio never passes through our servers on a self-hosted deployment: it flows from the carrier, through your tunnel, to your gateway, and from there to Google's model.

Your call data: by default yes, in two forms, both for your own dashboard. The carrier's recording of each phone call is copied to our storage so you can replay it (a Talk to agent session in your portal has no carrier, so your gateway records it and uploads it to the same storage), and the transcript is sent to us so it appears in your dashboard, Voice API, and webhooks. Each is a per-deployment switch in your portal: turn recording off and we keep no audio; turn transcript shipping off and the transcript exists only as a text file on the gateway host. We never listen to calls live.

We always keep the call metadata we need for billing and your dashboard: caller and called numbers, direction, duration, timing, and cost per call. Recordings, retention, and deletion are covered in detail below.

No. The gateway listens on localhost only - it's not reachable from outside your machine. All external traffic flows through an outbound-only encrypted Cloudflare tunnel. You don't need to open inbound ports or configure firewall rules.

Cloudflare handles DDoS protection at the edge before anything reaches your instance. Internal diagnostic endpoints are blocked from tunnel traffic entirely - they're only accessible from the machine itself.

Every inbound event from the phone network is verified using Ed25519 digital signatures with replay protection, so captured events cannot be re-sent later. If the signing key is missing or invalid, the gateway rejects all webhooks - it fails closed, not open.

The system fails closed by default. If the webhook signing key is missing, webhooks are rejected. The platform also refuses to generate install tokens without the signing key configured, so an insecure deployment can't ship silently.

No. The real-time audio stream for every call is authenticated with a one-time token that's tied to that specific call. Once the call ends, the token is useless - it can't be reused, replayed, or redirected to another session.

Public callers are boxed in the same way. Every public call gets its own isolated agent session, so one caller's conversation can never leak into another's, and owner-level tools are never even offered on a public call. That is enforced in the gateway code, not by the prompt.

Through a one-time encrypted install token. The token is encrypted with AES-256-GCM, can only be used once, expires in 15 minutes, and is permanently deleted from our systems after you redeem it. Only audit metadata is retained.

No. In BYOK (bring-your-own-key) mode, your voice API key is validated once in the dashboard, encrypted into a single-use install token (AES-256-GCM, 15-minute expiry), and delivered directly to your gateway. After redemption the token is permanently deleted from our systems - the raw key lives only on your server's .env file from that point on.

The companion agent secret (used by our platform to authenticate heartbeat and webhook reports from your gateway) is stored on our side only as a SHA-256 hash. We never see the raw value after you receive it.

Never. The gateway installs on Linux, and there it runs under your OpenClaw service user with strict systemd sandboxing: no privilege escalation, read-only system directories, isolated temp space, and no core dumps.

No. API keys never flow through the Cloudflare tunnel at all. The tunnel is one-way inbound only - it carries call webhooks and voice media from the phone network into your gateway. Your voice API key (BYOK mode) lives in your gateway's local .env and is used only for outbound calls to the voice AI provider. The telephony API key (platform mode) stays in our hardware-backed vault and is proxied through our signaling function. Neither key ever traverses the tunnel.

The cloudflared process itself is also forked by the installer before any secrets are exported to the environment, so the tunnel process holds no API keys in memory even on your own server.

What Cloudflare can see as tunnel traffic transits its edge: call-event metadata (caller number, called number, timestamps, call IDs) and the live audio media stream. HTTPS is terminated at the Cloudflare edge before being re-encrypted to your gateway through the tunnel - this is the same visibility any service using Cloudflare Tunnels has. Cloudflare does not store HTTPS traffic by default. A direct-to-origin option (no Cloudflare in the media path) is on the roadmap for customers who need stronger media isolation.

No. The telephony provider API key stays in a hardware-backed secret vault run by one of the major cloud providers, on our infrastructure. When your gateway needs to control a call, it sends an authenticated request to our signaling proxy, which validates your identity, applies rate limits, and makes the call on your behalf.

A compromised gateway cannot extract the API key or control another customer's phone number.

No. Our platform enforces strict allowlists on every request your gateway makes. Tunnel hostnames have to end in an approved domain, the audio stream has to match the tunnel registered for your deployment, and every call is locked to the deployment that created it.

A tampered gateway can't reroute traffic to an attacker, exfiltrate audio, or touch another customer's calls.

Every deployment has per-day and per-month minute caps enforced on our side, independent of your gateway. If anything starts placing more calls than expected, the caps halt it quickly. We also cross-check the call durations your gateway reports against the phone network's own records, so a tampered gateway can't under-report usage.

Every binary and bundle is SHA-256 verified before anything runs on your server. The skill bundle is additionally scanned for path traversal and symlink attacks before extraction.

The installer never evaluates token fields as shell commands. Each field is strictly validated against an allowlist before it touches any shell context, and the command-line wrapper accepts only a fixed set of subcommands - so even a tampered token can't smuggle arbitrary commands into your server.

Recording is on by default so you can review calls from your dashboard right away. The carrier records a phone call; when it ends, we copy the MP3 into our cloud storage. A Talk to agent session in your portal has no carrier, so your voice gateway records it itself and uploads it to the same storage when it ends. Either way the recording is kept where only your authenticated dashboard session can play it back, through a link that expires five minutes after it is issued. Our own staff can reach a recording only under the restricted-access, strong-authentication, and access-logging controls in our Privacy Policy, and we use that access to diagnose call quality, never to train models. The carrier keeps its own copy under its own retention terms.

You can turn recording off at any time from your portal; from then on we store no audio, from phone calls or Talk to agent sessions. A deleted recording stays recoverable in our cloud storage for up to 7 days, a safeguard against accidental deletion, and is then permanently erased. Retention and deletion follow our Privacy Policy, and you can have any call, any caller's calls, or every call on your deployment deleted on request. Deleting the deployment releases its number and wipes its configuration.

Transcripts are a separate switch. By default the transcript is sent to us, which is what powers your dashboard, the Voice API, and webhooks. Turn shipping off and it exists only as a text file in the gateway's transcripts/ folder on the gateway host. Direct storage to your own bucket is coming in a future release.

No. The installer will never create users, add SSH keys, open firewall ports, install telemetry, inject cron jobs, or send usage data. It creates a systemd service to keep the gateway running, but otherwise only writes to the install directory and the OpenClaw workspace.

Self-hosted, your agent runs on your server, through your tunnel, under your control, and the platform is built so that it cannot reach it: no inbound access, no carrier key on your box, no owner-level tools for public callers, and a voice key you can bring yourself so Google bills you directly and we never hold it. What we do hold by default, recordings and transcripts, exists for your dashboard and is yours to switch off or delete. We built every layer with the assumption that attackers will try - and designed it so they can't get in.