Privacy & security
How Concierge protects your access and data
You decide who can reach your agent and when it may call. Concierge checks those permissions before placing or connecting a call.
1. Your account controls access
Codex handles the work. Concierge checks your account and authenticates each owner call before sharing private context.
Knowing your phone number or claiming to be you is not enough to access your private context.
2. External callers stay isolated
Someone you allow through can provide information for the current task.
That caller cannot access your unrelated Codex work or private notes, and cannot act with your permissions.
3. Caller ID is not enough
Concierge checks owner phone enrollment and authenticates the call using verified carrier information. A matching caller ID alone does not unlock private context.
4. A request cannot grant permission
An allowed personal or transactional request still has to pass the other checks. Asking for a call cannot override identity checks, contact permissions, or your phone allowance.
5. What Concierge checks before calling
- Your account and subscription
- Permission to contact the person
- Your calling preferences and quiet hours
- The Codex task and connected computer
- Whether a call is already active and phone time is available
- The destination and phone service
- Whether this request has already been carried out
6. Avoiding duplicate calls
If the carrier takes too long to respond, Concierge checks what happened before trying the action again.
7. Where your data lives
Your conversations and work history stay in Codex.
Concierge keeps the account, phone, contact, permission, and usage information needed to run the service. It also keeps limited coordination data for connecting calls and resuming recent work. It does not create a separate transcript or personal-memory database.
8. Permissions are checked again later
Codex can use its supported scheduling tools to revisit a task later.
A scheduled task does not reserve phone time or permission to call. Concierge checks the current permissions and limits when the task requests a call.
9. Phone limits still apply
When phone time runs out, an agent cannot bypass the limit by switching to another carrier channel.
10. Supported calling options
Telnyx carries production calls. Twilio remains fallback and reference.
A feature offered by the carrier is not necessarily available in Concierge. The availability guide lists the current limits.
11. Current beta availability
Some phone and Windows paths are still being validated for the current beta. See Current availability and limits for the latest supported boundaries.
12. Limits of these controls
These controls reduce risk. They do not make software or telecom systems immune from compromise.
How the checks work
Who can authorize an owner action
Verified owner / native context
↓
Authority checks
↓
Allowed owner action
External caller
↓
Task input / isolation
└── NO owner-authority pathOwner requests still pass permission checks. External callers can contribute to a task without gaining owner access.
The diagram omits credentials, sensitive identifiers, and database details.
Phone event flow
Phone event ↓ authenticate + route ↓ owner or external ↓ bound native context ↓ policy + effect checks ↓ provider action ↕ outcome reconciliation
Concierge authenticates the call before connecting it to Codex. It checks permissions before asking the carrier to act, and checks the result when the outcome is uncertain.
The diagram omits credentials, sensitive identifiers, and database details.
Scheduled recheck
native Codex work ↓ scheduled recheck ↓ later wake ↓ read CURRENT work + authority + limits ↓ no phone action OR newly authorized guarded action
When a scheduled task resumes, it checks the current work, permissions, and limits before requesting a call.
The diagram omits credentials, sensitive identifiers, and database details.