Compliance lives below your application code.

Every Saperly number carries automatic AI disclosure, first-class consent records that are checked at call time and are revocable, and an immutable, append-only audit trail of every call, message, and compliance event. These run in the carrier path, not in your application — so an agent cannot accidentally route around them.

For US application-to-person SMS, Saperly registers your brand and campaign for 10DLC as part of provisioning, so messages send over compliant, registered routes rather than being filtered or blocked.

Saperly owns signaling, identity, compliance, the record, and billing. Conversation media stays in-network on the underlying carrier — call audio never passes through Saperly servers. In hosted mode the voice agent runs in-network; in manual mode we relay each turn to your runtime as text plus tool calls. Either way, the audio path does not reach Saperly compute.

Agents authenticate with scoped sap_sk_ API keys. Each key carries only the scopes it needs, an optional number allow-list, and an optional spend cap, so a single agent can never exceed its limits. The workspace an action belongs to is always read from the key — never from client input. Every action is attributed on the audit trail.

Saperly runs on hardened, enterprise-grade cloud infrastructure as a thin control plane over a carrier network, with a PCI-compliant payment processor for payments. Traffic is served over HTTPS only. Data is handled per our Privacy Policy; terms of use are in our Terms of Service.

Found a vulnerability or have a security question? Email hello@saperly.com. We aim to respond within one business day.