Encryption
Data is encrypted in transit using TLS whenever it moves between your browser, our systems, and the services we rely on. Data is encrypted at rest as well: secrets and call recordings are stored with strong encryption managed through a dedicated key-management service.
Hosting & network
Good2Go runs on our cloud infrastructure in the United States. Application services run inside a private network, and databases are not exposed directly to the public internet. Access between components is restricted to what each service needs to function.
Tenant data isolation
Good2Go is multi-tenant, and each business’s data is logically isolated from every other business. Queries are scoped to the signed-in account, so one customer cannot see or reach another customer’s data.
Access controls & least privilege
Access to production systems is limited to the people who need it, following the principle of least privilege. Within your own account, roles control who on your team can see and change what.
Backups
The database is backed up automatically so your account data can be recovered in the event of a failure.
Call recordings
Call recording is opt-in per business — it is off unless you turn it on. When recordings are enabled, they are encrypted at rest and set to auto-expire after roughly 12 months, so recordings are not kept indefinitely.
Payments
Payments are processed by Stripe. Card details are handled by Stripe, and we do not store full card numbers on our systems.
Reporting a vulnerability
We welcome responsible disclosure. If you believe you’ve found a security issue, please email support@good2goaisupport.com with the details and steps to reproduce. Please give us a reasonable opportunity to investigate and fix the issue before disclosing it publicly.
What we do and don’t claim
We describe our security measures factually. We do not currently hold formal third-party security or compliance certifications, and nothing on this page should be read as claiming one. If your organization requires a specific certification or a security review, please contact us to discuss your needs.
Your responsibilities
Security is shared. You remain responsible for your own regulatory and legal obligations, including obtaining any required consent to record calls in the jurisdictions where you and your customers operate. If you enable call recording, make sure you comply with applicable call-recording consent laws.