A safer front door

Thirty-six changes with one goal: a business can sign up, verify and come back on its own, and everything a visitor, a contact or a new organization can reach is tightly bounded.

Signing up and signing in

• Forgot your password? — a link on the sign-in page emails a reset link that works once, for an hour, and signs out every other session.
• One answer for a wrong email or password — sign-in no longer reveals which addresses have an account, and email addresses match whatever their capitals.
• Limits that stop abuse — signup, code resend, verification, sign-in and invitations each stop after a sensible number of attempts. A bot challenge on the signup form is ready to switch on.
• Terms and Privacy on record — every signup, invitation and first social sign-in shows a linked sentence and records which version was accepted, and when.
• Signup that survives interruptions — closing the tab or reloading during verification no longer strands an account, and the code step comes back after a reload.
• Invitations that expire — invitation links work for 7 days, can be resent, and say who invited you and as what.
• Verified email changes — a new sign-in email takes effect only after a code sent to it is entered, and the old address is told.

Locked-down edges

• Signed phone events only — inbound texts and call events are accepted only when Twilio signed them, and only for the account that signed them.
• A teammate acts for the contact in front of it — on a contact’s conversation, your teammate’s tools work for that contact only, and lessons learned there wait for your review.
• Web chat protections — daily message caps per website chat and per visitor, and a visitor can no longer claim to be another contact by typing their email.
• Safer integrations and pages — outbound webhooks and the contact lookup cannot reach private network addresses; cross-site requests are refused, Markdown cannot carry scripts, and every page sends modern security headers.

Legal safeguards

• Recording starts off — call recording is off for new organizations until a spoken notice plays, and turning it on shows what the Owner is taking on.
• Teammates never deny being an AI — on every channel, a teammate sincerely asked says it is an AI teammate.

Messaging and Meta

• Accurate ad reporting — the Conversions API reports your pipeline stages by their role and holds the stages you have not mapped yet.
• The reply window respected — a teammate no longer tries to answer on Facebook or Instagram after Meta’s 24-hour reply window has closed.