Hosting and encryption
Sparwise runs on DigitalOcean in the United States: the app, its PostgreSQL database and the documents your company uploads (in DigitalOcean Spaces). Our domain’s DNS is managed by Cloudflare.
- All traffic to getsparwise.com and app.getsparwise.com is served over HTTPS.
- The app only connects to its database over TLS.
- Keys for our voice, AI, payment and email providers are kept as encrypted secrets in our hosting platform, never in our code.
- Webhooks from our voice provider are checked with a signed HMAC and rejected if stale, so call results can’t be forged or replayed.
Accounts and sign-in
| Passwords | Stored only as one-way hashes. At least 8 characters. |
| Changing your password | Asks for your current password, then signs out every other device. |
| Reset links | Work once and expire after 60 minutes. Using one signs out every device. |
| Forgot password | Answers the same whether or not an email has an account, so it can’t be used to find out who uses Sparwise. |
| Rate limits | Sign-in, password reset and password change are rate limited to slow down guessing. |
Card details never touch our servers. Checkout and the billing portal are hosted by Stripe.
Roles and workspaces
Each company gets its own workspace. Every request is checked against the signed-in person’s workspace, so one company can’t see another company’s people, scenarios or calls. Inside a workspace, what you see depends on your role:
| Role | Can see and change |
|---|---|
| Employee | Their own practice calls, scores and feedback, and their profile and call settings. |
| Manager | Scenarios, assignments, surprise calls, the team list and the dashboard for their company. |
| Admin | Everything a manager can, plus billing and subscription. |
Calls and consent
Every Sparwise call is a practice call with an AI and is presented that way.
Surprise calls go to an employee’s own phone at an unannounced time, so they need the employee’s say-so. We only schedule one when the employee has turned surprise calls on in their profile and saved a phone number, and only inside the hours and time zone they set. If a manager schedules calls for people who haven’t opted in, those people are skipped. If they turn the setting off, calls already scheduled are skipped.
Phone numbers are used only for practice calls, never for marketing.
AI and your data
During a call, speech goes to ElevenLabs in real time so the AI customer can respond, and the call is transcribed. After the call, the transcript, the scenario and your company’s material go to Anthropic, which returns scores and written feedback.
We don’t use your content to train AI models, and we use these providers’ business services, whose terms don’t allow them to train on it. Scores are for coaching; Sparwise makes no employment decisions.
Deleting data
- Removing an employee deletes their practice calls, transcripts, scores and scheduled surprise calls.
- Deleting a scenario or one of its documents deletes the uploaded file from storage too.
- When a company closes its account, we delete its data as described in our Privacy Policy.
Service providers
We rely on these companies to run Sparwise. Each gets only the data it needs for its job. Our Privacy Policy lists exactly what each one receives.
| Provider | What it does for us |
|---|---|
| DigitalOcean | Hosting, database and file storage (US) |
| Cloudflare | Domain name (DNS) |
| ElevenLabs | AI voice and call transcription |
| Twilio | Places and connects phone calls |
| Anthropic | AI scoring and written feedback |
| Stripe | Payments and subscriptions |
| Mailgun | Sends account emails, such as password resets |
| Google Analytics | Visits to this website only, never the app |
Certifications
Sparwise is a young product and does not hold SOC 2, ISO 27001 or similar certifications yet. If your security review needs more detail than this page, email us and we’ll answer your questionnaire honestly.
Report a security issue
If you think you’ve found a vulnerability, please tell us before telling anyone else. Include what you found and how to reproduce it. We’ll confirm we got it and keep you updated while we fix it.