How Yawp controls outbound work.

Who authorizes an outbound action?

A person, at one of two moments — before an errand starts, or before an individual call or message goes out. A multi-day errand is created first and does nothing until someone confirms it; that confirmation is the authorization for the work inside the limits it was given. A standalone call or email is queued as the exact thing the assistant wants to do and waits.

Approval away from a screen uses an 8-digit code that is readable only where a signed-in human can read it. The model never sees it, so a confused — or manipulated — assistant cannot approve its own work. What gets approved is transmitted byte for byte, with no model call in between. The first message to any new counterparty is always held this way, even inside an errand already confirmed.

Two things are not gated per action, and you should know both before you decide this is enough. An assistant can be set to trust mode for calls, in which case it dials without waiting for you — the authorization is the setting, made once, not the call. And a workspace can turn on email autopilot for errands, which lets later replies to a counterparty you already approved go out without a second approval, up to the spending ceiling that errand carries; anything above the ceiling comes back to a human. Both are off by default, and both are workspace settings rather than something the assistant can grant itself.

Connector clients that can render a form may offer approve and deny inline instead of a code — a form only you can click. That is an explicit per-key opt-in, off by default, so a stolen key cannot be the proof a human decided.

The full statement is in the privacy policy

Which services process data?

A short list, each doing one job. The names below are what is configured today; the model, the voice and the mail provider are configurable, so those slots can change — and when the list changes, this page and the privacy policy change with it.

• ClerkSign-in and account identity. Every signed-in request.
• RailwayHosting, application servers and databases. Our servers and databases run in the United States. Always.
• AnthropicThe default model that drafts and conducts conversations. Errand content is sent to it to do that work. Every model turn, unless another model is configured.
• OpenAIAn alternate model for the same work. Conditional — only while a gpt-* model is the configured one.
• GoogleAn alternate model for the same work, and one of the two optional speech-to-text engines. Conditional — only while a gemini-* model or Google transcription is configured.
• TwilioPlacing and carrying phone calls, and sending the text messages that tell you an errand needs you. Every call and every text.
• Voice synthesisTurning the assistant's words into the voice a callee hears — ElevenLabs by default, configurable to Google or Amazon. It is reached through Twilio, not as a direct integration. Every outbound call.
• Speech to textTurning what a callee says into text. By default this is Twilio's own engine; Deepgram or Google can be configured instead. Every call — a named third engine only while one is configured.
• PostmarkSending and receiving email. Every email.
• InngestScheduling the background work that moves an errand along. It receives identifiers and timings, not the content of your calls or messages. Always.
• StripeSubscriptions and payments. Only when you subscribe or pay.

Yawp sends no errand content to an analytics, advertising or session-replay service, and trains no model on it.

The full statement is in the privacy policy

How long is content kept?

There are two different answers, and the difference is the one a questionnaire actually asks about: some content is deleted, and some is redacted in place because the row it lives on carries things that are not content.

• 365 daysCall transcripts and conversation turns are deleted. A settled conversation goes whole, dated from the last thing said in it — never half a transcript.
• 365 daysEmail bodies are redacted: the text is blanked in place and stamped, while the row survives, because it carries the threading token, the delivery identifiers and the approval state that the conversation depends on.
• 30 daysVoice playback diagnostics — a record of what was handed to the voice engine and how much of it played before an interruption. It contains no audio, and no call is ever recorded.

A window is when content becomes eligible to go, not a promise it left that day, and content still attached to an errand or an approval that never finished can stay longer.

The full statement is in the privacy policy

How are recipients told they are dealing with AI?

On a call, the assistant identifies itself as an AI assistant calling on behalf of a named person, in its opening words, before the conversation gets going. On email, every outbound message carries a line saying Yawp is an AI assistant, with a link to a page explaining who wrote and why.

Both are composed by our software rather than by the model, and appended outside anything the model can edit. That is the point: a disclosure a model writes is a disclosure a model can be talked out of writing. These cannot be removed by prompting it — not by the person the assistant works for, and not by anyone the assistant is talking to.

The full statement is in the privacy policy

Can we get a DPA?

Available on request. Write to [email protected] and say who is asking and for which workspace. Security questionnaires go to the same address.