How CallWarden protects your account

The Budget Firewall

CallWarden is blocked at the code level from ever changing your daily budget, bids, targeting or ad copy. Google’s permission for the Ads API is all-or-nothing, so we enforce the limit ourselves. Every request CallWarden makes to Google is checked against a short allowlist before it leaves our servers. Only three kinds of change can pass:

1. Rating a lead through Google’s own “Rate this lead” feedback, so Google can credit invalid ones.
2. Replying to a message lead with a short first response.
3. Pausing or resuming your Local Services campaigns (Shield and Agency plans). The only field we may change is the campaign’s status, and only to Paused or Enabled, never Removed. This happens when the bot-flood circuit breaker trips under rules you control, or when you press Resume. Each campaign goes back to exactly the status it had before.

Anything else is refused before it is sent: budgets, bidding strategies, target CPA, locations and other targeting, ad schedules, ads, and Google’s catch-all “mutate” endpoint. An automated test proves each of these is blocked, and it runs on every change to our code. Every pause and resume is listed on your Spam Shield page.

Call recordings: 35-day auto-purge

Raw call audio is encrypted in transit and automatically deleted 35 days after the call, once the 30-day window for claiming credits has closed.

• Google only plays call recordings to a signed-in browser, so the optional Chrome Audio Bridge downloads them using your own Google sign-in.
• The extension uploads each recording over HTTPS straight to private storage, using a single-use upload link. We check its size and fingerprint before transcribing it.
• After 35 days an automatic job deletes the audio. What we keep is the masked transcript and the evidence behind each credit claim.

Personal data is masked before AI review

Card numbers, Social Security numbers, phone numbers, emails and street addresses are masked before AI classification. Caller names are masked before anything is stored.

• Our transcription provider removes card numbers as it transcribes.
• Before a transcript reaches the AI that classifies the call, CallWarden replaces Social Security numbers, phone numbers, emails, addresses and any remaining card numbers with tokens like [SSN].
• Names can’t be found by a pattern, so the AI marks them during classification and CallWarden removes them before saving. We only ever store the masked transcript.
• Our AI providers don’t train their models on your calls: the transcription service is opted out of model improvement, and the AI service doesn’t train on API data.

Your data is walled off from every other customer

• Database isolation: leads, calls, alerts, billing records and AI feedback sit behind Postgres row-level security. Every page you load and every change you make runs as your organization only, so even a bug in a query can’t show you another customer’s rows.
• Encrypted credentials: your Google connection token and any Slack or alert-channel addresses are encrypted with AES-256-GCM and locked to your account. A copy moved into another customer’s record can’t be decrypted.
• Nothing reusable on file: sign-in sessions, Chrome extension keys and verification codes are stored only as one-way fingerprints, never the codes themselves. Google access tokens are kept in memory for under an hour and never stored.
• Our own access: our internal dashboard uses a restricted, read-only database login that can’t see Google tokens, caller phone numbers, recording links or message contents.

The fewest Google permissions possible

• Sign-in asks only for your name and email address.
• The Google Ads connection asks only for Google Ads access, in a separate step. We never ask for Gmail, Google Drive, Google Sheets or other Google data.
• Disconnect anytime in Settings and we revoke the Google grant immediately. You can also remove CallWarden in your Google Account permissions.

The Chrome Audio Bridge

• It checks whether Chrome is signed in to Google by looking at cookie names only. It never reads, stores or sends cookie values.
• It downloads only the recordings CallWarden asks for, for your own leads, and talks only to CallWarden’s own website.
• It never changes anything in Google Ads.

Payments

Billing runs on Stripe. Your card details go straight to Stripe; CallWarden never sees or stores card numbers.

Report a security issue

Email [contact email] with the details. We’ll confirm we received it and keep you updated while we fix it. See also our Privacy Policy and Terms of Service.