Security, in the detail your review needs.
Three controls, what each one does and what you still decide yourself. For documentation, ask us and say what your review requires.
Security controls.
What your IT team will ask about first.
- Payment-safe recording
- Recording pauses while a card number is read out, then resumes.
- Pause and resume
- Company sign-in
- Staff sign in through your identity provider; accounts are created and removed from it.
- SAML SSO · SCIM
- Signed webhooks
- Every webhook carries a signature header so your systems can verify it came from Tizbo.
- Signed webhooks
Payment-safe recording
Pause and resume
Recording pauses while a card number is read out, then resumes on its own, so card details are not captured in the audio file.
Test it on your own payment flow, and ask your payment provider what applies to you. Pausing is one control and does not replace a proper payment process.
Company sign-in
SAML SSO · SCIM
Staff sign in through your identity provider, and accounts are created and removed from it. When someone leaves, disabling them in your provider removes their phone account too.
Keep an emergency administrator account for any time your identity provider is unavailable.
Signed webhooks
Tizbo-Signature
Every call event sent to your endpoint carries a Tizbo-Signature header, so your code can check the request came from Tizbo before acting on it.
Verify the signature against the raw request body first, and reject anything that does not match.
Read: Designing a webhook consumer that does not drop call events
Questions your security review will ask.
Not answered here? Send us the question and we will answer it for your own setup.
Contact usHow do our staff sign in?
Through your identity provider using SAML SSO. Accounts are created and removed with SCIM, so leavers lose access when you disable them.
Can card numbers end up in recordings?
Recording pauses while a card number is read out and resumes on its own. We suggest testing it on your own payment flow.
How do we know a webhook came from Tizbo?
Each one carries a Tizbo-Signature header that your code can verify before acting.
Can you send us security documentation for our review?
Yes. Contact us and say what your review needs, and the team will reply with what is available.
Talk to the team that will set it up.
Bring your current call flows and we will walk through them using your own numbers.