Security and access

Your agency account controls your clients’ agents, phone numbers and billing, so it is worth protecting well. This page covers the protections that are always on, the ones you should switch on, and how Wozena keeps each client’s data separate.

Sign-in protection#

These apply to every account, yours and your clients’ users:

• Passwords must be at least 12 characters.
• Passwords that have appeared in a known data breach are refused with “That password has appeared in a data breach. Please choose a different one.” The strength meter on the form is a guide only; the length and breach checks are what count.
• New accounts must verify their email before they can sign in. Until then, sign-in shows “Please verify your email first — check your inbox for the verification link.”
• Sign-in and password reset have a short cool-down after repeated attempts. Wait a moment and try again.
• Resetting a forgotten password signs the account out everywhere.

Two-factor authentication#

Two-factor authentication (2FA) adds a second step at sign-in: a 6-digit code from an authenticator app on your phone. Anyone who learns your password still can’t get in without it.

Turn it on

1. Open security settings
   Go to SettingsSecurity and click “Enable 2FA”.
2. Confirm your password
   Enter it under “Confirm your password” and click “Continue”. Accounts that only sign in with Google skip this step.
3. Scan the QR code
   Scan the code with your authenticator app. The app starts showing a 6-digit code for your account.
4. Save your recovery codes
   Under “Recovery codes — save these somewhere safe”, copy the codes into a password manager or another safe place. You need one if you lose your phone.
5. Confirm
   Type the current 6-digit code into “Code” and click “Confirm”. You see “Two-factor enabled”.

Signing in with 2FA

After your password, the “Two-factor authentication” page asks for the code from your authenticator app. Enter it and click “Verify”. If you don’t have your phone, click “Use a recovery code instead” and enter one of your saved recovery codes.

Manage 2FA

When 2FA is on, SettingsSecurity shows “Two-factor authentication is on” with two buttons. Both ask for your password.

• “Recovery codes” creates a new set of codes. Your old codes stop working, so save the new ones straight away.
• “Disable” turns 2FA off. Your account stops asking for a second step.

Password, email and sessions#

All of these are in SettingsSecurity.

Google sign-in#

“Continue with Google” appears only on the main Wozena sign-in page. It never appears on your branded portal address or your custom domain, so your clients always sign in there with email and password. If you sign in with Google using the same email as an existing verified account, the two are linked.

Delete your account#

1. Hand over ownership if you need to
   If you are the only Owner of your agency, make someone else Owner first in SettingsTeam. Until you do, deletion is blocked with “Transfer agency ownership before deleting this account”. See Team, roles and invites.
2. Start the deletion
   In SettingsSecurity, under “Delete account”, type DELETE and click “Delete account”.
3. Confirm by email
   You see “Check your email to confirm account deletion”. Click the link in that email within 1 hour.

Deleting your account removes your memberships and profile picture. Audit and business records stay, but refer to you only by an anonymous ID.

How client data is kept apart#

• Every request is checked on our servers, against our own records, to work out which agency and client the signed-in person belongs to.
• Data is always filtered to your agency. Client users are further limited to their own client, whatever page or link they open.
• A record from another agency or client behaves as if it doesn’t exist. People can’t even confirm that it is there.
• Client users never see call costs or your provider costs.

What each role can see and change is set out in Team, roles and invites.

How credentials are stored#

• Your Retell API key and your CRM and calendar credentials are encrypted when saved. After that only the last 4 characters are ever shown, for example •••• 4f2a.
• Only Owners can view or change the Retell and Stripe connections.
• Error messages saved from automation runs have secrets removed before they are stored.

See Connect Retell and CRMs and calendars.

The audit log#

Audit Log records who changed what, and when, across your agency: client permission changes, integration changes, invites and more. Owners and Admins can see it. Details, including its limits, are in Calls and reports.

Recommended setup for agencies#

• Turn on 2FA for every Owner and Admin. These accounts can reach every client. Ask your client admins to turn it on too.
• Keep Owners to a minimum. One or two people who run the business. Everyone else who builds agents should be Admin.
• Give clients the lowest role that works. Use Client member for people who only need to look at calls.
• Remove people the day they leave. Removing an agency teammate cuts their access to every client immediately.
• Review your active sessions now and then, and sign out any you don’t recognise.
• Check the audit log after anything unexpected, such as a client permission you didn’t change.

Troubleshooting#