Your calls are sensitive. We treat them that way.
How VoiceVera protects call recordings, transcripts and the people in them, from the moment a call arrives to the moment it is deleted.
The path of a call
- Arrival. Recordings and call records come in over encrypted connections from your phone system, an SFTP drop or an upload. Phone numbers are replaced by keyed IDs straight away.
- Transcription. Audio is turned into text. Audio is never sent to a language model.
- Redaction. Before any AI analysis, card numbers, bank details, email addresses, ID numbers and links with parameters are removed from the text, and agents are replaced by aliases.
- Analysis. Only the redacted text is analyzed. Every quote the AI cites is checked against the transcript by code.
- Storage. Results are stored per organization, encrypted with that organization's own keys, and kept for the period the organization sets.
- Deletion. At the end of the retention period, or on request, calls are deleted.
No training on your data
Your audio and transcripts are used only to deliver the service to you. They are never used to train AI models, ours or anyone else's.
Security questionnaires
Need more detail for your security or procurement review? We are happy to complete your questionnaire and walk your team through our controls. Write to info@voicevera.io.
What protects your data
Phone numbers protected
Each organization has its own secret key for turning phone numbers into IDs, so IDs cannot be matched across organizations. Seeing a full number needs a permission and a reason, and is logged.
Redaction before AI
A versioned set of rules removes cards, bank details, emails, ID numbers and links with parameters before analysis. The rule version is stored with every result. How to redact call transcripts.
Agents as aliases
AI models see agents only as stable aliases. Names are restored by code, inside your workspace.
Per-organization keys
Sensitive data is encrypted with keys that belong to one organization. Keys can be rotated. Connections use TLS.
Organizations kept apart
Every table is scoped to one organization and the database enforces it. Automated tests check that no organization can read another's data.
Roles and two-step sign-in
Role-based access for every page and action, with two-step sign-in. Agents never see pages meant for supervisors.
Append-only access log
Sign-ins, playbacks, number views, exports and settings changes are written to a log that cannot be edited.
Retention, export, deletion
You set how long calls are kept, can export everything, and can delete all calls of a specific customer.
Results you can trace
Results are append-only and record the prompt, schema, rule and model versions that produced them.
AI providers
VoiceVera uses third-party AI models for parts of the analysis. They receive only redacted text, never audio and never phone numbers, and they receive it only to perform the analysis. A list of the providers that process call data is available to customers on request.
Certifications
VoiceVera does not hold a SOC 2, ISO 27001 or HIPAA certification today. We describe our controls openly instead, and we answer security questionnaires in full.
Recording consent
Your organization decides which calls are recorded and is responsible for giving callers the notice or asking for the consent that applies where you operate. We can share a sample consent message on request.
Report a vulnerability
If you believe you have found a security issue on voicevera.io or in the service, please email info@voicevera.io with the subject “Security report”. Please do not access data that is not yours or disrupt the service while testing.
Ask us anything about security
We'll walk your security team through the details.