How Sauti protects data
Encryption, masking, access control, auditing and the rules no one can switch off.
Sauti was designed around one rule: the people a campaign reaches should never be exposed by the campaign's own tools. This page explains how.
Encryption#
- Every organisation has its own encryption keys. A supporter's phone number, email, chat identifier and ID number are encrypted with them as soon as they arrive.
- Keys are held in a dedicated key service, protected by an outer key layer, and are never stored with the data.
- To find people without decrypting them (for example to spot duplicates or honour an opt-out), Sauti uses keyed one-way hashes.
Masking#
Campaign staff see masked values such as 07•• ••• •42, in every screen, export, report, notification, log and error message. Contact fields cannot be used as merge fields. Free text such as notes and incident reports is scanned and contact details are removed.
Only three services can decrypt#
The website and the campaign workspace never decrypt contact details. Only these isolated services can:
| Service | Why |
|---|---|
| Dispatch | To send a message at the moment it leaves |
| Call bridge | To connect a phone-bank or callback call without showing either number |
| Reveal service | For an audited operator reveal or an approved encrypted export, with a recorded reason |
Access control#
- Two-factor sign-in for everyone; passkeys or hardware keys for sensitive operator roles.
- Roles with granular permissions, limited to a campaign and a geographic area.
- Separation enforced in the application and in the database, so a failure in one still blocks access.
- Operator access only from the operator network, with short sessions.
Rules no one can switch off#
- Opt-outs (STOP, ACHA, SITAKI) are honoured immediately, everywhere.
- Quiet hours cannot be shortened.
- Content screening blocks hate speech and incitement; campaigns cannot override it.
- No profiling: Sauti does not score supporters or infer their politics, ethnicity, gender or age.
Accountability#
- Important actions are written to a hash-linked audit trail kept for at least five years.
- Reveals are audited before the value is released.
- Small groups are hidden in reports so no community can be singled out.
Hosting and retention#
Personal data is retained only as long as needed (for example, supporter records are deleted or anonymised 90 days after a campaign ends) and backups are encrypted. See Data protection for campaigns for the full schedule.