VoxiScore

Trust center

Call recordings are sensitive. This page shows how we protect them, what we don’t offer yet, and what you need for a security review.

Last updated: November 7, 2026

Compliance

Where we stand today, including what isn’t in place yet.

Data Processing Agreement
Available
Available to every customer, with 30 days’ notice before a new subprocessor starts processing your data.
US hosting
Available
The app, database and call audio are hosted in the United States. Encrypted database backups are stored in eastern North America.
SOC 2
Not yet
We haven’t completed a SOC 2 audit. Until we do, we’ll answer your security questionnaire and share evidence for the controls below.
HIPAA
Not yet
We don’t sign business associate agreements yet, so calls with patients’ health information aren’t supported.
Card payments by phone
Not yet
Calls in which card payments are taken aren’t supported yet, because stored audio isn’t redacted.

How the product is built to protect your data. These controls are ours to describe, not the findings of an outside auditor.

Two layers of separation: Every query is limited to your organization in the app. Postgres row-level security enforces the same boundary again in the database, on every table that holds customer data.Checked by automated tests on every change
Fails closed: The app connects with a database role that can’t bypass row-level security. A query with no organization set is refused.Checked by automated tests on every change
Separate audio paths: Each organization’s audio has its own storage path and is served only through the app, after an authorization check. Imports that point at another organization’s audio, agents or rubrics are rejected.Checked by automated tests on every change

In transit: TLS from the browser to the app, with HSTS. Database connections verify the server’s certificate, and calls to our providers use HTTPS.
At rest: The database, its backups and call audio are encrypted at rest. Audio uses a dedicated KMS key with automatic rotation.

Roles and departments: Agent, supervisor and admin roles, with access scoped by department. Deactivated users can no longer sign in.
Single sign-on: SAML single sign-on on the Business plan, which you can require for your team.

Audio retention you control: Choose not to keep raw audio, or keep it from 1 day up to 10 years, depending on your plan. Temporary processing copies are removed automatically, within 2 days at most.
Optional transcript redaction: Turn on redaction of personal, payment-card and health details on any plan. Redacted details never reach our database or AI scoring models. Stored audio isn’t redacted.
No call content in logs: Logs, error reports and background jobs carry identifiers and error reasons, not transcripts or audio.

Append-only audit log: Access to recordings, exports and deletions is recorded. Database triggers reject any attempt to change or delete an audit record, and records are kept for at least 1 year.Checked by automated tests on every change
Backups: Continuous database archiving and daily encrypted backups allow point-in-time recovery. Backups are kept for 35 days.

Privacy Policy
How we handle personal data.
View
Terms of Service
The terms that apply to your use of VoxiScore.
View
Subprocessors
Who processes customer data for us, and how we announce changes.
View
Data Processing Agreement
Our data processing terms. We’ll send you a copy to sign.
Request by email
Security evidence
Details of our controls and how each one is tested, plus answers to your security questionnaire.
Request by email

AI and speech-to-text providers only receive data when they are enabled for your workspace.