Security

Rolagon processes voice, so it is reasonable to ask where it goes. This page says what is actually true today. It makes no certification claims, because we hold none. If you need something formal for a procurement review, email help@rolagon.com and we will tell you plainly what we can and cannot provide.

Access control

• Authentication is handled by Supabase, with email sign-in or Google. Rolagon never stores your password.
• Every page and API route outside the public marketing pages is gated at the edge. An unauthenticated request to an API returns 401; to a page, it redirects to the login screen. There is no route that serves account data without a session.
• Application data is protected by row-level security in the database, so a query runs as your user rather than as an administrator. Team and billing views additionally require the caller to be an owner or manager of the workspace they are asking about.

Where call recordings live

This is the part worth reading twice, and it is the same as what the privacy policy says. The live conversation is carried by ElevenLabs, which provides the synthetic prospect's voice and the speech recognition. Recordings and transcripts are held by ElevenLabs; Rolagon retrieves them from there when you replay a call. Rolagon's own database stores the call's metadata and its scorecard, not the audio.

After a call, the transcript goes to Anthropicto produce the scorecard. If the live coach is on, short excerpts go there during the call to generate suggestions. Both providers' standard API terms prevent them from using content submitted through their APIs to train their models.

Payments

Card details go straight to Stripeand never reach Rolagon's servers. Stripe carries the PCI obligations for handling them; we hold a customer reference and a subscription state, nothing more.

Who else processes your data

Supabase (authentication and database), Vercel (hosting and request logs), Stripe (payments), ElevenLabs (voice, recordings, transcription), Anthropic (scoring and live coaching), Resend (transactional email) and Logo.dev (the carrier logos on our public pages, served directly to your browser). The full list, with what each one sees, is in the privacy policy.

What your manager can see

Worth stating on a security page rather than burying it: if your employer runs the workspace, the owner and managers can see your scorecards, the calls behind them and your minute usage. That is the product working as intended, not a leak, but treat your practice calls as visible to your employer.

Tracking

There are no advertising or analytics cookies. The only cookies are a session cookie that keeps you signed in and, if you arrived through a partner link, a referral cookie.

Reporting a problem

If you believe you have found a vulnerability, email help@rolagon.comwith enough detail to reproduce it. We do not run a paid bug-bounty programme, and we would still rather hear from you than not. Please do not test against other people's accounts or workspaces.