Current

Security

Last updated 13 October 2026

Current holds the list your business runs on: who you called, what they said, when to call back. Here's how it's protected, in plain terms. Questions, or found a problem? Email hello@obramade.com and a person answers.

Signing in

  • You sign in with Google. Current never sees or stores your Google password.
  • Your session lives in a cookie your browser can't hand to scripts on the page, and it only travels over an encrypted connection.

Your workspace is yours

  • Every request for a prospect, call, note or setting is checked against the workspace you're signed into. Another workspace's records can't be read, changed or attached to yours, even by guessing an ID.
  • People you invite see the workspace you invite them to, and nothing else.

Keys and passwords you give us

  • The Twilio and email-sending keys you connect are encrypted with AES-256-GCM before they're stored, using a key that never leaves our servers.
  • They're checked with the provider before they're saved, and never sent back to a browser after that, not even to you.

Calls and recordings

  • Calls from the browser go through your own Twilio account, so the minutes, numbers and recordings are in an account you control and can close.
  • Calls to your Current number are only answered by Current if you switch that on, and switching it off gives your number back whatever answered it before.
  • Recording is off until you turn it on. When it's on and you call a state where everyone on the line must agree to being recorded, Current plays a short notice first, to the person you called and to anyone you add to the call.

Claude and other assistants

  • Current for Claude is listed in Claude's connector directory and connects with OAuth: you approve it on Current's own page, for one workspace.
  • The tokens it receives are stored only as one-way hashes, so even a copy of our database wouldn't let anyone use them.
  • Anything that changes your data or reaches someone outside Current asks you first. It can't place a call: dialling is always you pressing a button.
  • You can disconnect it at any time from Settings → AI assistants.

The API and webhooks

  • API keys belong to one workspace, can only be made by its owner or an admin, and are shown once. Only a one-way hash is stored. A key stops working the moment it's revoked, or when the person who made it stops being an admin or leaves the workspace; they and the workspace's admins are emailed when that happens.
  • Each key can make 120 requests a minute, and every request is recorded in the workspace's request log (Settings → API), without its contents.
  • The API follows the same rules as the app: workspace scoping, do-not-contact, plan limits. It can't delete records, place calls or send messages.
  • Webhooks are signed (HMAC-SHA256) so receivers can check they came from Current, and only ever go to public https addresses. Current checks that again each time it connects, so a webhook can't be pointed at a private network.

No trackers

  • No advertising pixels, no analytics scripts, no third-party trackers on any page, signed in or not. The privacy policy says exactly what's counted and how.

Where your data lives

  • The app runs on Netlify; your records are in a Postgres database hosted by Neon in the United States (Virginia), encrypted at rest.
  • Every connection to the app and between the app and the database is encrypted.
  • The site tells browsers not to show it inside other sites' frames, to blunt clickjacking.

Leaving, any time

  • Export everything (every prospect, person, number, note, call and template) as CSV or JSON from Settings, in one click.
  • Delete your account and your workspace's data from Settings, without asking anyone.

Reporting a security problem

If you think you've found a vulnerability, email hello@obramade.com with what you found and how to reproduce it. We'll reply, fix it, and say what changed. Please don't access or change other people's data while testing.