Security & privacy

Nine rules that cannot be loosened by a setting anywhere. They are fixed in code and, wherever possible, covered by a test. Here they are in plain words, matching SECURITY.md.

  1. The server never runs an action itself. A tool call becomes a command for the page that declared it, and that page's own code — yours, in code mode, or the engine's, in map mode — is what runs it. The server neither touches your page nor calls your site directly. An action name a page didn't declare gets "there is no such tool" back.
  2. No secret reaches your site. Our voice provider's API key lives on our server only. What reaches the page: your public key (already sitting in your script tag), a short-lived room token, and a session key that is stored on our server only as a SHA-256 hash.
  3. The public key is paired with an origin allowlist. The key is public — what actually protects your minutes is the browser's Origin header, which a page cannot forge, checked against your tenant's allowed-origin list. An empty list allows nothing. Tool webhooks are separately guarded by a shared secret, compared in constant time and never logged.
  4. The microphone opens only on a click. The widget being on the page starts nothing; a visitor's click does, and the browser asks first. After a navigation caused by a filter, the same conversation continues — that's a continuation of the same click, not a new one. Stopping the call releases the microphone.
  5. The page is read only where you marked it. The widget's own page reading is the title, the path, and elements you marked with data-katman-context. No form fields, no cookies, no storage, no free page text. A site that wants more supplies it itself, through context() in code mode.
  6. Logs carry no page content. Only action names, error tokens and numbers. Your tenant's slug is logged; your origins are not.
  7. A command settles once. Pending becomes applied or failed, and a settled command never settles again — an invalid transition throws rather than silently accepting it. A double post caused by a page reload changes nothing.
  8. Everything a page sends back is bounded. A spoken summary capped at 600 characters, 12 KB of data, an error reduced to a token only. Up to 24 actions in code mode, 8 parameters each, 600 characters of description. These bounds are the product's own, chosen because this is customer-edited data that ends up in a prompt — not limits imposed by the voice provider.
  9. The minute counter is server-side. The voice provider's own call report is the measure; failing that, wall-clock time; failing that, the plan's cap. A conversation that never properly closed is never billed past the cap.

What we don't claim

heygerry holds no certification today — no ISO standard, no SOC 2 report, no KVKK certificate. The nine rules above are what the code actually does, and that is what we're telling you here; nothing on this page is a compliance claim beyond it. Ask us for the current data-processing terms before you sign.

Questions: hello@heygerry.io. These pages describe what is built today; nothing here is a promise about what is not.