Security and data handling
This page describes obligations that travel with the data, not just good practice. It is reviewed alongside Talki’s DPA.
What flows through this API
Section titled “What flows through this API”Personal data of your customer’s callers: phone numbers, names, appointment details, and a generated summary of what was discussed on a call. Treat every response as personal data under the GDPR.
What Talki retains
Section titled “What Talki retains”- Call records, including the agent’s summary, are purged on a rolling retention window.
- Deleted accounts are removed after a grace period.
- Verbatim transcripts and audio are not exposed through this API, as a standing policy rather than an accident of the current schema.
Your obligations
Section titled “Your obligations”- Store credentials server-side, encrypted at rest.
- Minimise: pull the fields you need, not whole resources you will not read.
- Honour deletion. If a Talki record disappears, mirror that downstream.
- Never copy production payloads into documentation, tickets or test fixtures.