Security & Trust
Your customers’ chats and calls: who sees them, and how they’re kept safe.
If an AI is going to talk to people for you, you should know who can read those conversations and what happens to them. The plain answers are below; the technical detail your IT person or security reviewer will want is folded underneath, and this page lists only what we really do today.
Plain answers
Who can read my customers’ chats and calls?
Your own team, by role: admins and editors can open every chat, call transcript and email in the Command Center; viewers can read but not change anything. At Lina, access is limited to the people who need it to run, support or secure the service — today, the owner — and they are bound by confidentiality. Nobody else: every organization’s data is kept apart on every request, and a sign-in for one organization is refused on another’s address. The full commitment is in the Data Processing Addendum.
Does the AI train on my customers’ data?
No. Lina does not use your content or your customers’ personal information to train AI models, and we never sell it. By default, chat answers come from Lina’s own AI: open models that run on Lina’s own Cloudflare account (Workers AI), and Cloudflare states that Workers AI keeps none of a request after answering it and does not use it to train models. Google Gemini and OpenAI back it up. Google also handles phone calls and web search; OpenAI also writes email-reply drafts and summaries and runs the Website Editor. Each company is listed, with what it receives, on our Subprocessors page. Your knowledge base is used to answer your customers, and for nothing else.
Where is my data stored?
In one database on Railway, in the United States, with each organization’s data separated on every request rather than in separate copies. It is encrypted in transit everywhere, backed up every night, and each backup is restore-tested and deleted after 30 days. Call audio is kept only if you turn call recording on; voicemail messages are always recorded and kept with the call record; transcripts are kept so you can read what was said. Details are in the Privacy Policy.
How do I delete it?
From the Command Center: erase one person (their contact and call details), delete a conversation, or download your data as one file first (call and voicemail audio and files over 50 MB are not in that file — open a call in the Command Center to play its recording and save the ones you need). If you cancel, your space is kept for a while so you can export or come back, then deleted, and backups expire after that — the exact timings are in the Terms and the Privacy Policy. Email support@linasystems.org to delete sooner.
Will my customers know they’re talking to an AI?
Yes. Every call opens with a fixed notice that they are speaking with an AI assistant, and the chat and phone assistants are instructed never to claim to be human. Those rules live in the platform’s code, above anything an organization changes.
What if it says something wrong?
It can: the assistants are instructed to answer only from your knowledge and to hand off when unsure, but like any AI they can still get something wrong, so review what they say. When an answer is wrong you correct it once in the Command Center, and the assistants use your correction from their next message. Every sign-in and privileged change is logged.
The technical details, for your IT person or security reviewer
Everything below is what we actually run today — the architecture, the AI safety floor, access control, secrets, transport, backups and monitoring, and how to report a problem.
01 — Architecture & isolation
A multi-tenant service, isolated on every request.
Lina is multi-tenant: every organization runs on the same application and the same Postgres database, hosted on Railway in the United States in a Railway project of its own. What keeps organizations apart is enforced in code on every request, and tested.
- Each request is resolved to exactly one organization from the web address it arrives on, and every read and write goes to that organization’s own storage area.
- Sign-in sessions carry their organization and are refused on any other organization’s address.
- Credentials for inbound integrations (email, notes sync) are issued per organization; a platform-wide secret never opens an organization’s space.
- The Staff assistant runs as its own service, reached only through the organization’s own site, which tells it which organization is asking.
- Each phone number belongs to one organization. Calls are routed by the number dialed and refused when that organization’s plan or billing does not allow them.
- Automated tests drive two real organizations side by side through the real application to check that nothing crosses over.
02 — The AI safety floor
A few rules written into the platform’s code.
Each organization can edit its assistant’s prompts, knowledge and notes — so the rules that must always hold are not kept there. They are part of the platform code and head every conversation, above anything an organization adds:
These are instructions the AI receives on every conversation, not a guarantee: like any AI, it can still get something wrong, so review what your assistant says.
- Before a call reaches the AI agent, and before any hold message the organization sets, the phone system itself plays one fixed sentence with the organization’s name, word for word: “Thanks for calling [your organization’s name] — you're talking with our AI assistant, not a person, and this call is transcribed.” (“Thanks for calling [your organization’s name] — you're talking with our AI assistant, not a person, and this call is transcribed and recorded.” when the organization records calls). Before voicemail records a message, it plays “You've reached an automated voicemail line. Your message will be recorded.” The agent itself is instructed never to claim to be human.
- Call recording is off by default. When an organization turns it on, the opening sentence says so, and live call audio is kept only after that sentence has finished playing. Voicemail messages are recorded whether or not call recording is on; Lina copies each one from Twilio into the call record and then deletes it at Twilio. A recording Lina has not copied stays at Twilio until the call record is deleted or the caller is erased.
- An organization’s own editable safety rules (for example on public positions) sit on top of this floor; they can add to it but cannot remove it.
03 — Access control & accountability
Roles checked by the server. Admin actions logged.
- Role-based access control (RBAC): admin, editor and viewer roles are enforced by the server on every Command Center API — not just hidden in the interface. Viewers are read-only.
- Features a plan does not include are refused by the server (HTTP 403), even if called directly.
- Passwords are stored as salted PBKDF2 hashes. Password-reset links are single-use and bound to their organization, and changing a password ends that account’s other sessions.
- An audit log records privileged admin actions, and sign-ins trigger alerts an organization can subscribe to.
- Payment and gift details in call records stay hidden in the Command Center unless an admin asks to see them.
- An admin can download the organization’s data as one file (call and voicemail audio and files over 50 MB are not in it), and erase one person’s contact and call details. (Erasing a person does not rewrite chat transcripts; those conversations are deleted separately.)
04 — Secrets, AI providers & integrations
Keys stay on our side, and never come back out.
- API keys and tokens are stored as Railway environment variables — never in source code. The Command Center shows only whether each one is set, never its value, and our web application’s logs mask secret-shaped values.
- Lina runs the AI on its own accounts: open models on its own Cloudflare account (Workers AI) for chat, and Google Gemini and OpenAI as backup and for phone calls, web search, email-reply drafts and the Website Editor. Your team never needs an AI provider account or API key.
- Every model call is written to the organization’s append-only usage ledger and checked against the plan’s monthly allowance; past it, the assistant stops calling the model instead of running up a bill.
- Incoming webhooks are verified: payment events are signature-checked, phone requests are signature-validated and rejected if they do not verify, and inbound email arrives HMAC-signed from our email worker.
05 — Transport
Encrypted in transit, strict in the browser.
- HTTPS everywhere. Railway provides and renews the TLS certificates for linasystems.org, every organization’s subdomain, and connected custom domains.
- Every page refuses to be shown inside another website’s frame, except the chat window your chat button opens on your own website; that window carries no Command Center sign-in. Our pricing, product and legal pages also carry a strict Content Security Policy, and our pages load nothing from third-party servers — no trackers, no font or script CDNs.
- Public chat is rate-limited per visitor and per organization.
06 — Reliability & operations
Backed up nightly, deployed only when CI passes, watched from outside.
- Nightly backups: a GitHub Actions job takes a snapshot of the platform’s data, checks that it is complete, then restores it into an empty database to prove it works — a rehearsed restore, every night. Snapshots are private workflow artifacts, deleted after 30 days. If the backup or the rehearsal fails, the owner is emailed.
- Deploys: production deploys from the main branch and Railway is set to wait for CI, so a change ships only after the automated test suite (more than 5,000 automated tests) and secret scanning pass.
- Monitoring: an external uptime monitor on Cloudflare checks each Lina service every 5 minutes and alerts the owner (on Telegram, with email as the fallback) when one goes down and when it recovers. The application also emails the owner about server errors, billing events and failed backups.
- Rollback is by hand: the owner redeploys the last good version. There is no automatic rollback.
Our goals are to restore service within 4 hours of a major outage and to lose at most the last day of data, since backups are nightly. These are goals, not guarantees — Lina does not offer an uptime SLA, and we do not yet hold a third-party certification such as SOC 2.
07 — Responsible disclosure
Found a security problem? Tell us.
Email security@linasystems.org with what you found and the steps to reproduce it. We will acknowledge your report within 3 business days, keep you updated while we fix it, and credit you if you would like. Please test only against your own account: do not access or change other organizations’ data, degrade the service, or run automated scans against customer sites. We will not pursue good-faith research that follows these rules. Our contact details are also published at /.well-known/security.txt.
For your security reviewer
Questions about security? Ask us.
Read the Data Processing Addendum, the Subprocessors list, the Privacy Policy and the Terms of Service, or reach us at hello@linasystems.org. We are happy to answer a security questionnaire.