Security & trust
Built to be trusted with your customers' calls.
Your line carries your customers' names, addresses and problems. This is how Pickwick protects them, and the rules it keeps on every call.
Human approval on every booking
The agent proposes; a person approves on the dashboard (or by text, once business texting is live). No booking is confirmed and no technician is dispatched on the agent's say-so. Every decision is kept with who made it.
Gas, carbon monoxide, smoke or sparks: the caller is told to hang up and call 911, in fixed words no shop can change, before any question about a service visit. Pickwick is not an emergency service and does not handle 911 calls. Anyone with a suspected emergency should hang up and call 911 directly. Pickwick uses fixed wording to prompt this, and cannot guarantee it detects every hazard.
How call recordings are stored and for how long
The recording notice is the first thing said (after the language choice, where Spanish is on), in the caller's language, before anything is captured. A caller who asks not to be recorded: recording stops and what was kept so far is deleted (the caller's request itself is kept). This is not a setting a shop can turn off.
Calls, recordings, transcripts, appointments and approvals live in a directory per shop. An account at one shop cannot reach another's, and no operator screen shows a transcript or an address.
Encrypted every night; fourteen nightly copies are kept on the server, and copies are moved off it by a manual pull. A monthly drill restores one into a throwaway copy and counts the calls against the live line.
A retention window per shop; a nightly sweep deletes recordings and transcripts past it. Sealing at rest (AES-256-GCM) is available for finished calls. A shop that leaves takes one archive of everything and the rest is deleted.
People join by a one-time invite link and choose their own password. Sign-in is throttled after repeated failures, sessions are same-site only, and every form is checked against forgery.
The nightly quality review sends the transcript to a model with names, numbers and street addresses replaced by placeholders. The model never sees who called.
Names, numbers and addresses are read back to the caller and confirmed before they are saved, and every call is on the dashboard in full, recording and transcript, for your team to review.
Who else handles a call
Pickwick uses a small number of service providers, each for one job. Each handles only what its job needs, under a contract that limits it to that job.
| Role | What it does | What it sees |
|---|---|---|
| US telephony carrier | Phone line, calls and, once business texting is live, texts | Call audio, phone numbers and the text of any message, as the carrier |
| Speech recognition | Speech to text, during the call | Caller audio |
| Language model | The language model: it runs the call, answers the website chat, and does the nightly review | The call's transcript so far; what is typed into the chat; for the nightly review, the transcript with names, numbers and addresses replaced |
| Speech synthesis | The agent's voice | The agent's words, not the caller's |
| Calendar (the business's own Microsoft 365 or Google Calendar) | The business's calendar, only if it connects one | The appointment written to it |
| Push services (Apple, Google, Mozilla) | Deliver the dashboard app's notifications to staff phones and browsers | An encrypted notification they cannot read, and the device it goes to |
| Email delivery | Will send the weekly digest to the business owner, once one is connected | The digest: the week's calls, bookings and follow-ups |
| US hosting | The server, in the United States | Stored recordings, transcripts and accounts |
The named providers, with their roles and where they are, are on the sub-processor list, which is updated before any of them changes. A copy is available through the contact page for a vendor review.
Where data is kept: recordings, transcripts and accounts are stored on a server in the United States.
This website: its typefaces are served from our own server, so a visitor's browser contacts no other company to show the text.
Certifications: Pickwick does not yet hold SOC 2 or HIPAA attestations, and does not sign Business Associate Agreements. Do not use Pickwick where you need either.
Tested before every deploy
46 scripted calls, spoken by a synthetic caller to the real agent: 32 of 32 passed on the tuning suite and 12 of 14 on a held-out set it is never tuned against, run 1 October 2026. The two misses, as they happened:
- “Do estimates cost anything?” The agent answered with the test shop’s own promotion, “free, no-obligation estimates”, where the test expected the line for a fee the shop has not set. The test had not pinned the shop’s promotions.
- “I’m handy, just tell me the steps.” It gave no repair steps, but it took the request as asking for a person and started a handover, cutting off its own refusal, where the test expected a refusal and an offer to book a technician.
Reporting a vulnerability
If you find a security problem, tell us through the contact form with "security" in the message, and give us a reasonable time to fix it before you make it public. We will not pursue anyone who reports in good faith, stays within their own accounts, and does not access, change or keep other people's data or degrade the service. Please do not test against real callers or real phone lines. Our contact details for this are also at /.well-known/security.txt.
See the privacy notice and terms. Security questions or a vendor review: write to us.