Trust
Plain facts about how we handle your data
Eight products, one company. We name every provider that touches your data, state exactly what we encrypt, and link to per-product addenda that go deeper.
Where it runs
Everything runs on Cloudflare's network
NeuralConfig owns no servers or virtual machines. All eight products run as Cloudflare Workers or Pages, with data in Cloudflare's own managed storage.
Compute: Workers and Pages
Every product runs as Cloudflare Workers or Pages functions. There is no NeuralConfig-owned server, VM, or container behind any product.
Storage: D1, KV, R2, Durable Objects
Databases live in Cloudflare D1, cache in Workers KV. StrandCalls also uses R2 for caller photos and generated audio, and Durable Objects for live call state.
Network: DNS, TLS, DDoS
Cloudflare's network handles DNS, TLS termination, and always-on DDoS mitigation in front of every product. TLS certificates are managed by Cloudflare.
Third-party providers
Who else handles your data
Some features need providers outside Cloudflare. We list them here by function. Each product's privacy addendum at /privacy/ goes into detail on retention and sharing.
Payments: Stripe
Stripe processes card payments for paid plans. Card numbers go to Stripe and never reach NeuralConfig systems. We keep only Stripe's customer and subscription identifiers.
Calls and texts: Twilio
Twilio carries StrandCalls phone calls and text messages. If a business enables call recording (off by default), the recording is held at Twilio.
AI models: xAI and Workers AI
xAI runs StrandCalls' realtime voice model and after-call summaries. Cloudflare Workers AI runs the built-in AI for NeuralRepo, Dashboard Gallery, and CP-MCP's image tool, using open-weight models on Cloudflare's network.
Sign-in and email: Google, GitHub, Apple, Resend
NeuralRepo offers GitHub, Google, and Apple sign-in plus one-time email links delivered by Resend. CP Word List uses Google sign-in. Businesses can connect Google Calendar to StrandCalls for booking availability.
Your own AI key (NeuralRepo Pro)
If you add your own Anthropic, OpenAI, or OpenRouter key, the features that use it send content to that provider under your account.
MCP servers: relay only
R1-MCP, SZ-MCP, CP-MCP, and Probe MCP relay requests between your AI assistant—for example, Claude—and your network platform. They pass your platform's answers to your assistant and keep no copy of that data.
Data protection
Encryption in transit, at rest, and beyond
Cloudflare handles the outer layer of encryption. For secrets that require stronger protection, our own code adds a second layer before storage.
In transit: HTTPS everywhere
Every product is served over HTTPS with certificates managed by Cloudflare. neuralconfig.com refuses TLS 1.0 and 1.1. Modern browsers connect with TLS 1.3.
At rest: Cloudflare's encryption
Cloudflare encrypts data in D1, Workers KV, and R2 at rest. This covers all product databases, caches, and StrandCalls media files.
Secrets: AES-256-GCM before storage
Platform passwords and API credentials in the MCP servers and CP Word List, R1-MCP client secrets, and NeuralRepo users' AI provider keys are encrypted with AES-256-GCM by our own code before storage. They are never shown back in any dashboard.
Sessions and tokens: one-way hashes
NeuralRepo sessions, API keys, and MCP tokens; MCP server tokens and sessions; and StrandCalls sessions are stored only as one-way hashes.
Authentication
How you sign in to each product
Most products use identity providers or one-time links rather than passwords stored at NeuralConfig.
NeuralRepo: four options
Sign in with GitHub, Google, Apple, or a one-time email link that expires after 15 minutes. Dashboard Gallery has no accounts.
StrandCalls and CP Word List
StrandCalls businesses sign in with an emailed link. CP Word List uses Google sign-in.
MCP servers: OAuth 2.1
AI assistants connect to the MCP servers using OAuth 2.1. The tokens issued are stored only as hashes.
AI safety
Guardrails for AI acting on your network
The MCP servers let an AI assistant query and change a live network. Two safeguards limit the blast radius: a sandbox that controls what code can reach, and an optional confirmation step before a change lands.
R1-MCP: isolated V8 sandbox
R1-MCP never gives the AI one tool per API call. Claude writes a short script; the server runs it in an isolated V8 sandbox with a 30-second cap that can reach only the RUCKUS One API.
Write Guard: confirm before you change
With Write Guard enabled, every call that would change the network is shown first—naming the target tenant—and runs only after explicit approval. Approval expires after 10 minutes.
No copy of your platform data
The MCP servers relay your platform's responses to your AI assistant and keep no copy of that data.
Compliance
Certifications and qualified oversight
NeuralConfig holds no SOC 2, ISO, or similar certification of its own. Our infrastructure provider and payment processor do.
Cloudflare's attestations
Cloudflare holds SOC 2 Type II, ISO/IEC 27001, and PCI DSS Level 1 attestations. These belong to Cloudflare. Details are in their Trust Hub.
Card data: handled by Stripe
Stripe handles all card payments. Card numbers go to Stripe and never reach NeuralConfig systems.
CISSP-led security work
Security decisions are led by a CISSP (Certified Information Systems Security Professional) who also holds wireless security and network certifications: CWSP, CWDP, CWAP, and CCNP.
StrandCalls
How StrandCalls handles calls and texts
StrandCalls answers a business's phone calls with an AI assistant and, when enabled, sends follow-up texts. The rules below apply to every business on the platform.
AI disclosure on every call
Every call opens with a fixed disclosure that the caller has reached an AI assistant, and states whether the call is recorded or only transcribed. Businesses cannot edit or remove it.
Call recording: off by default
Recording is off unless the business turns it on. When it is on, recordings are held at Twilio, not at NeuralConfig.
Text consent asked on the call
Before sending a booking confirmation or reminder, the assistant asks the caller during the call whether a text is okay. If the caller says no, that number gets no texts from that business.
Automated texts require carrier approval
Automated texts that aren't a direct reply to a booking—missed-call replies, review requests, offers—are sent only after the business's carrier registration is approved.
Promotional offers: separate opt-in
Occasional promotional texts or calls go only to callers who said yes to a separate question asked after a booking. That question makes clear that agreeing is not required to book.
Opt out at any time
Reply STOP (UNSUBSCRIBE, CANCEL, END, QUIT) to stop texts; HELP for help; START to resume. Press 9 on an automated offer call to stop future calls. Numbers are never sold or used to market NeuralConfig. StrandCalls privacy addendum.
Privacy & reporting
Analytics, privacy, and security contact
Our site analytics uses no cookies and does no cross-site tracking. Security issues go straight to the team that built the system.
Site analytics: GoatCounter
neuralconfig.com uses GoatCounter for page-view counts—no cookies, no cross-site tracking, no advertising networks, no tracking pixels. It is the only third-party script on our pages; fonts are served from our own domain.
Your data and privacy addenda
We don't sell personal data. Each product's privacy addendum states what it keeps, who it shares with, retention periods, and how to delete your data. Start at /privacy/.
Report a security issue
Email security@neuralconfig.com. It reaches the people who build and run these systems directly. For general questions: support@support.neuralconfig.com.
Questions about this page?
If something here isn't clear, or you need more detail for a procurement review, reach out.
Contact us