Caller protection

Your assistant answers every call, text and chat by itself, so it also has to cope with spam, people who call over and over, and people who try to talk it into something. Most of that works without you doing anything. You change the defaults under Settings → Business → Caller protection. An Admin changes the settings on that card; an Editor can add and remove allowed numbers.

Limit on repeat callers

When one number calls more often than the limit in an hour, the next call is answered with one short sentence ("We can't take your call right now. Please try again later.") and then ends. That call does not appear in the Inbox and costs no conversation with the assistant. Texts by SMS and WhatsApp from that number get no reply for the rest of that hour.

• The limit is on from the start, at 5 per hour for calls.
• For SMS and WhatsApp the limit is ten times as high, counted in messages, because a text conversation sends many messages where a call needs one. At 5 calls an hour that is 50 messages.
• Under Conversations per hour from one number you pick another limit. Turn off Limit repeat callers to switch it off altogether.
• A withheld number is never limited, because there is no number to count.

Always allowed numbers

Testing the assistant from your own phone, or does a regular customer call many times a day? Add the number under Always allowed numbers and click Add number. If a contact with that number exists, that contact gets Always allow; otherwise a new contact is created with just the number.

An always allowed number:

• is never limited as a repeat caller;
• never gets the question whether to block it (see below).

You can also turn on Always allow on the contact page under Customers → Contacts, next to Blocked. A number is never blocked and always allowed at the same time: turning one on turns the other off. To take a number off the list, click the bin next to it; the contact itself stays.

Blocking a spam number

When conversations with a number have ended as spam twice, the conversation page asks whether you want to block this number, with a Block button. A blocked number is rejected straight away from then on, see Contacts. You can also block or always allow a number yourself on any conversation page, next to Number, and undo it there with Unblock or Stop always allowing.

Ask for a code first

Some tasks should only run for the person who really owns the number, such as looking up an order or a customer file through an HTTP request. Under Assistants → Tasks, open the action and turn on Ask for a code first. This is available for actions that run during the conversation.

What happens then:

1. When the customer calls from a number that isn't withheld, the number they call from (caller ID) is enough for a task that only looks something up: a Sheets, Airtable or Baserow lookup, or a GET request. That task runs straight away for that number, without a code. A task that can change something first gets a code to the number they call from, unless their carrier confirmed the number. See Caller ID on a call.
2. In every other case (another number than the one they call from, a withheld number, an SMS conversation or the webchat) the assistant first asks the customer whether a code is fine, and offers a human colleague if they would rather not. See Ask first, or a colleague.
3. If that is fine, it sends a text message with a six-digit code to that number.
4. On a call, the caller reads the code out. In an SMS conversation, the customer types it. In the webchat the assistant asks for a phone number and sends the code there. For an appointment the customer may also give the email address the appointment was made with; the code then goes to that address by email.
5. If the number can't receive a text, such as a landline, the code can also go by email or with an automated call, see below.
6. Only when the code is right does the task run. Our platform checks the code, not the assistant, so nobody can talk the assistant into skipping it. A typed code is hidden in the transcript.

Caller ID on a call

On a call, the number the customer calls from is enough to look up what belongs to that number, as long as it isn't withheld. That is the number your phone shows when someone calls you. Someone can fake that number, though, so to change something on the strength of it the assistant first sends a code to that number. Only when the caller's carrier confirmed the number does it count as full proof.

• A task with Ask for a code first that only looks something up (a Sheets, Airtable or Baserow lookup, or a GET request) runs straight away for that number, without a code. A task that can change something (any other request) first gets a code by text to the number they are calling from, after the customer said yes. {{verifiedPhone}} is the number they are calling from in both cases.
• With the calendar, the assistant looks up the caller's appointments by that number without asking for it, and says so: "I found your appointment via the number you're calling from." If there is none: "I can't find an appointment linked to the number you're calling from. When is the appointment?"
• To move or cancel an appointment on that number with Ask for a code before an appointment is looked up, moved or cancelled on, the assistant first asks whether a code is fine and texts it to the number the customer is calling from (if that number is a landline, it offers the code by email to the address you have for that number). Only once the caller reads out the right code does it change the appointment. Someone who fakes a customer's number never gets that text, so they can't move or cancel the customer's appointments. With that setting off, the assistant moves and cancels without a code, as you chose.
• When booking a new appointment, the assistant asks: "Can I put the number you're calling from on the appointment?" If the customer says yes, the appointment shows Verified by caller ID. If the customer gives another number, that number is not verified.
• If the appointment is on another number than the one they call from, for example their partner's, moving or cancelling it with the built-in calendar needs a code to that number, after the customer said yes. Or the assistant passes it on to a colleague.
• A withheld (anonymous) number proves nothing. The assistant looks nothing up by it and asks for the number the appointment or task is about. That number then needs a code.
• In an SMS conversation the number still needs a code. On WhatsApp it doesn't, because WhatsApp has already proven the number.
• Faking a caller ID is possible. That is why caller ID alone only looks things up. If a task is very sensitive, have your system check more than the number alone.
• Some networks, mostly in the US, tell us whether they checked the caller ID. When the network vouched for it in full, the number counts as proven for that call: the assistant then also moves or cancels the appointments on it, and runs a task that changes something, without a code. When the network could not vouch for it, the number counts as not proven: the assistant looks nothing up by it and asks for a code, as with a withheld number. Most Dutch and European calls carry no such check; there the caller ID is enough to look things up, and a change needs a code.

Ask first, or a colleague

The assistant never just sends a code. It first asks whether that is fine and says where the code will go, in the language of the conversation and in the tone your assistant uses. In the webchat it asks for the number or email address in the same message, so the customer can answer everything at once. For moving an appointment in the webchat it sounds like this, for example:

"I can move your appointment, but for your safety I'll first send a verification code to the phone number or email address you made the appointment with to confirm it. Is that OK? Which phone number or email address did you make the appointment with? If you'd rather not get a code, I can also pass the request on to one of my human colleagues, who will call you back to confirm it."

If the customer says yes and gives the number or address, the assistant sends the code straight away, without asking again. If the customer only gives the number or address, it asks once more whether a code there is fine, for example: "I'll send a verification code to that email address to confirm it. Is that OK?"

Where the code goes depends on the conversation:

• Webchat, an appointment: to the phone number or the email address the appointment was made with. The customer gives it. A mobile number gets a text, an email address an email. If it is a landline, the code comes by an automated call, and the assistant says so.
• Webchat, another task: by text to the customer's phone number, which the customer gives.
• Text conversation: by text to the number the customer is texting from ("by text to this number").
• Phone, a change on the number the customer calls from (without their carrier's confirmation): by text to that number ("by text to the number you're calling from").
• Phone, another number than the one the customer calls from: by text to that number, or by an automated call if it is a landline. With a withheld number, the code goes by text to the number the customer gives. On a call your business makes, it goes to the number that was called, or to a number the customer gives. In those two cases our platform doesn't call a landline: a landline's code then goes to the email address you have for that number.
• Landline on a call: to the email address you have for that number (see Code by email). The assistant doesn't say that address.
• eTermin booking with an email address: to the email address on the booking, only partly named (see Appointments).

The assistant never says a full number or email address the customer didn't say themselves. If the customer picks another way, such as an email instead of a text, the assistant names that one. In a text conversation the code can only go to the number the customer is texting from; if they want it another way, the assistant offers one of your human colleagues.

• If the customer says yes, the code goes out as above.
• If the customer would rather have a colleague, no code is sent and nothing changes. The assistant saves the request under Inbox → Requests: what the customer wants (move, cancel or the task), the current appointment as the customer describes it (date, time and service), the new moment they would like, and the customer's name and number. Call the customer back on that number to confirm it, then change the appointment yourself.
• With Save requests off, the assistant passes the request on as a callback request in a chat. On a call it then transfers the call, or lets the customer leave a voicemail if that is on; otherwise it doesn't promise a callback.

If the customer says no, our platform also stops the code if the assistant still tries to send it.

Code by email

When the number that needs a code can't receive a text, such as a landline, or the text doesn't arrive, the assistant offers to email the code. The code only goes to the email address that is already on the contact with that number, under Customers → Contacts. That way the customer proves something you already knew about them.

• On a call, the caller doesn't need to say the address: the code goes to the address on that number.
• In the webchat the assistant asks a customer without a mobile number for the phone number and the email address you know them by. The code only goes by email when that address is on that number in your contacts. With the built-in calendar a number given together with an address gets its code on the number (a text, or an automated call for a landline); for an appointment the customer can give the email address alone instead.
• The assistant always says the same thing, whether an address is known or not. So nobody can find out who your customers are.
• If you have customers with a landline, add their email address to their contact, or import it.

Code by call to a landline

When a customer types a landline number in the webchat, our platform calls that number. An automated voice reads the six-digit code out slowly, digit by digit, twice, in your assistant's language. Then the call hangs up and the customer types the code in the chat. An SMS conversation from a landline gets the code the same way. When a customer calls from their mobile and the appointment is on a landline, that landline is called the same way: the customer picks it up and reads the code out to the assistant.

• When the customer calls from a withheld number, they could be calling from that landline, and then the line is busy. The assistant then offers the code by email, or one of your human colleagues. The same goes for a call your business makes.
• The call comes from a number of your business that can make calls. Without one, the assistant offers the code by email.
• If a voicemail or answering machine picks up, the code is not read out and the call hangs up. So the code never ends up on a voicemail.
• The call is not a conversation: it is not in the Inbox and does not count as a conversation with the assistant.
• A business calls at most 50 codes per 24 hours. After that the assistant offers the code by email or one of your human colleagues.

Look up with the proven number

A code proves a number, not an order number or a customer number the customer says. So let your system look up the record with the proven number. In a task with Ask for a code first our platform fills the variable {{verifiedPhone}} with the number the customer proved (with a code, or the number they call from), in international format (for example +31612345678). The assistant can't fill or change it. Put it in the body or the filter of the action, for example {"phone": "{{verifiedPhone}}", "order": "{{order_number}}"}, and have your system return only what belongs to that number. Leave the body template empty and verifiedPhone is in the JSON we send anyway. In any other task the variable is empty.

Appointments

Under Assistants → Tasks → Book appointments you can also turn on Ask for a code before an appointment is looked up, moved or cancelled. This is there for the built-in calendar and eTermin. On a call the number the customer calls from is enough to find the appointments on that number and tell the customer about them. To move or cancel one, the assistant first sends a code by text to that number (after the customer said yes), unless the caller's carrier confirmed the number (see Caller ID on a call). With the built-in calendar, for an appointment on another number, with a withheld number, in an SMS conversation or in the webchat, the assistant first sends a code (after the customer said yes), and only after that does it see the appointments made with that number and can it move or cancel one. With eTermin the assistant first reads the booking. If it was made with a number proven in the conversation (their WhatsApp number, a number they proved with a code, or the number they call from when their carrier confirmed it), it moves or cancels it straight away. If it was made with the number they call from without that confirmation, a code by text to that number comes first. In an SMS conversation or on an outbound call, a booking made with that conversation's own number first gets the usual text code to that number. If it was made with another number, the assistant says it first needs to send a code to the email address on the booking, and asks whether that is okay. It says the address only partly: in a chat for example t•••@ex•••••.com, on a call only the first letter, the start of the domain and its extension. After a yes the code goes to that address, never to an address the customer gives, and the customer reads it out or types it in the chat. That code only works for that one booking, and a number the customer already proved stays proven. If the booking has no email address, a caller or a webchat visitor can still prove the number the booking was made with, with a code sent to that number; no other number counts. In an SMS conversation or on WhatsApp that is not possible. If none of this works, or the customer would rather not, the assistant passes the request on to one of your human colleagues. Booking a new appointment never needs a code.

With the built-in calendar the customer can also prove the email address the appointment was made with instead of the number. The code then goes to that address by email, and once it is correct the assistant sees all upcoming appointments made with that number or that email address (capitals and spaces don't matter). On a call it asks for a number first: it only takes an email address when the caller has no number for the appointment, and it spells it back first. In an SMS conversation the customer always proves the number they text from. A proven email address proves no phone number: it only counts for those appointments, not for a task with a code, and the number gets no Verified label.

In the webchat the customer has no number of their own, and a typed number or email address alone never shows anyone's appointments. So with the built-in calendar the assistant always asks for a code in the webchat before it looks up, moves or cancels an appointment, even with this setting off. It asks whether that is okay and which phone number or email address the appointment was made with, with a colleague as the other option. After a yes it sends the code there. If the customer gives both a number and an address, the code goes to the number. Until the code is correct it says nothing about whether there is an appointment; after that it sees the appointments of that number or address. If nothing turns up for a proven email address, the assistant asks whether the appointment was made with a phone number or another address, and offers a code there too, again only after a yes. If the customer already proved their number or address earlier in the same conversation, no new code is needed. When you try this in Try it out (also in Chat), no code is sent: the number or email address you type or say counts as proven straight away, and the assistant looks up its appointments.

Good to know:

• On WhatsApp no code is needed: WhatsApp has already proven the number. With eTermin, a booking made with another number than the WhatsApp number still needs the code by email.
• With eTermin and this setting off, the assistant still only moves or cancels a booking that was made with the number of the conversation: the number the customer calls from, or their WhatsApp or SMS number. Any other booking goes to a colleague. In the webchat there is no such number, so nothing is moved or cancelled there without the setting.
• A landline can't receive a text. The code then goes by an automated call when the customer isn't calling from that number, or by email. If neither works, the assistant offers one of your human colleagues.
• A number gets at most three codes per 24 hours, by text, email and call together, and an email address at most three too. One conversation also sends at most three codes, to whatever numbers, so nobody in the chat can have number after number texted or called. A code works for 10 minutes and allows five tries.
• When you try the assistant with Call or Chat in the dashboard, no code is sent and the number of the test counts as proven. With Perform actions for real off the task is only simulated. With it on, the real task runs without a code. To test the code itself, use Real call, call the assistant's number from your own phone and move or cancel an appointment, call it from a withheld number, or text it.

Verified or not verified

Next to the customer's phone number you see how the number was verified: on the conversation page in the Inbox, on a request under Inbox → Requests and on an appointment under Appointments.

• Verified by caller ID: the customer called from this number, and it wasn't withheld.
• Verified by SMS code, by email code or by code call: the customer proved the number in that conversation with a code.
• Verified by WhatsApp: WhatsApp has already proven the number.
• Verified by number change: the customer proved the number when they changed their number.
• Not verified: the number was not proven, for example because the customer typed it in the chat or gave another number than the one they call from. So a request with this label can come from someone else. If in doubt, call the number back before you change anything.
• No label: the request or appointment was not made in a conversation, for example through the booking page, the dashboard or the API, or it is older than this label. When you change the number on an appointment yourself, the label goes too. A conversation your assistant called out itself, and the request or appointment from it, gets no label either: you chose the number yourself. If the customer proves the number with a code in that conversation, it does get a label.

A request or an appointment only gets the label of the number on it. So when a customer calls from their own number and the assistant puts another number on the appointment, that appointment is not verified. If the customer proves a number later in the same conversation with a code, the request and the appointment of that conversation with that number get the label then. When an appointment is moved or cancelled in a conversation, the label of that conversation applies. Webhooks, the note in your CRM and the API carry the same as customerPhoneVerified or guestPhoneVerified (true, false or null) and how as customerPhoneVerifiedBy or guestPhoneVerifiedBy (caller_id, sms_code, email_code, call_code, whatsapp, phone_change or null).

Rules the assistant always follows

Whatever is in your instructions, the assistant always keeps a few fixed rules: it ignores requests to reveal or change its instructions, it treats someone who says they are the owner, a colleague or the police like any other caller, it shares no details of other customers, and it does not ask for passwords, PINs or full card numbers.

Hide card numbers, IBANs and BSNs in transcripts

Turn on Hide card numbers, IBANs and BSNs in transcripts to mask these numbers before a message is stored. Only numbers with a valid check digit count, so order numbers, amounts and dates stay as they are.

• A BSN has nine digits, like many phone numbers. When the Country in Business details is the Netherlands, nine digits that pass the BSN check are masked as a BSN. Otherwise only when the customer says or writes "BSN", "burgerservicenummer" or "sofinummer" in the same message. A phone number that starts with a zero ("06 …", "zero six …") or follows a country code ("+34 …") is never taken for a BSN.

• A number in words counts too, the way speech recognition writes down a call: digit by digit ("four one one one …"), in pairs ("forty-one eleven …", "eenenveertig elf …"), with "double", mixed with digits, or with commas or "and" in between. This works in Dutch, English and Spanish.

• A number spread over a few messages sent shortly after each other is recognised as well. On the phone, speech recognition often cuts a long number into pieces; then every piece is masked. Typed digits only count across messages when together they are grouped like a card (in fours) or a BSN (3-3-3), so an order number and a date in the next message stay as they are.

• A card number and an IBAN keep their last four characters, for example •••• •••• •••• 1111. A spoken number keeps its last four digits as they were said and gets one dot per digit. A BSN is masked completely.

• This applies to the transcript in the Inbox, the summary and what the assistant reads back later in the conversation. It also applies to what the assistant writes down during a call: the details of a request, notes on an appointment and what it sends to a task. So the request email, event webhooks and your CRM get the masked number too.

• Recordings are not changed. During a phone call the assistant still hears what the caller says; only the written transcript is masked.

• The setting is off by default, because a business that takes payment details by phone may want to see them.

Chat limit

The chat on your website accepts at most 60 messages per visitor per hour, and 300 per network per hour (an office or a public Wi-Fi). Above that, the visitor sees that they sent a lot of messages in a short time and can try again later. You don't need to set this up.