How does VoicaX isolate data between customers?

Isolation is enforced at the PostgreSQL layer with row-level security on every tenant-owned table. Policies resolve organisation membership server-side, so a request can only ever read rows belonging to the caller's organisation.

Is VoicaX GDPR compliant?

VoicaX supports GDPR obligations including a data processing agreement, sub-processor disclosure, data subject export and deletion, configurable retention periods, and audit logging of processing activity.

Are call recordings and transcripts stored?

Transcripts and call metadata are retained per your organisation's retention policy and are readable only by members of that organisation. Recording can be disabled entirely, and sensitive fields can be redacted before storage.

Can we run a security review before purchasing?

Yes. We walk security and procurement teams through the architecture, RLS model, encryption approach and audit coverage, and provide a security packet on request via the contact form.

Security

Trust is a platform primitive

VoicaX was designed as an enterprise multi-tenant platform from day one. Governance, isolation, and audit aren't add-ons — they're baked into the core.

Multi-tenancy

PostgreSQL row-level security. Every table enforces tenant boundaries at the database layer.

Encryption

TLS 1.2+ in transit. AES-256-GCM for provider credentials at rest.

Audit Logs

Every mutation across auth, billing, and platform admin is logged and queryable.

RBAC

Role- and permission-based access, evaluated on every request.

API Security

Hashed API keys, signed webhooks, and scoped permissions.

Data Ownership

Your data is yours. Full export via API — no lock-in.

Compliance

Aligned with the standards your buyers require

VoicaX's architecture supports the controls and evidence needed for SOC 2, GDPR, and HIPAA-aligned deployments. Ask us for our current attestation status.

Need a security review?

We happily walk security and procurement teams through our architecture.

Request security packet

Architecture

How VoicaX protects your data

Isolation, encryption, audit and detection — what each control actually does.

Tenant isolation enforced in the database

Every tenant-owned table in VoicaX has row-level security enabled, and every policy resolves the caller's organisation membership through security-definer helper functions. A bug in application code cannot leak another organisation's conversations, documents or billing records, because the database refuses the read.

Platform-level roles are stored in a dedicated role table, never on the user profile, which removes the classic privilege-escalation path where a user updates their own role field.

Encryption, secrets and credentials

All traffic is served over TLS 1.2 or higher. Provider credentials — AI keys, telephony tokens, payment gateway secrets — are encrypted at rest with AES-256-GCM and decrypted only inside server-side runtime code. Secrets are never returned to the browser, and never logged.

API keys issued to your systems are stored as hashes. Outbound webhooks are signed so your receivers can verify authenticity and reject replays.

Audit, monitoring and detection

Authentication events, billing changes, role assignments, customer provisioning and administrative actions are written to append-only audit logs that organisation owners and admins can query for their own tenant.

A platform security monitoring dashboard aggregates suspicious authentication and RPC patterns so tenant-data probing is detected early rather than discovered in a post-mortem.

Compliance posture

VoicaX's control set is designed to support SOC 2 Type II evidence collection and GDPR obligations, including data subject export and deletion, a data processing agreement, sub-processor transparency and configurable retention windows.

For healthcare and financial deployments we support restricted retention, redaction of sensitive fields in transcripts and regional data residency on request. Ask for the current attestation status before signing.

FAQ

Frequently asked questions

How does VoicaX isolate data between customers?: Isolation is enforced at the PostgreSQL layer with row-level security on every tenant-owned table. Policies resolve organisation membership server-side, so a request can only ever read rows belonging to the caller's organisation.
Is VoicaX GDPR compliant?: VoicaX supports GDPR obligations including a data processing agreement, sub-processor disclosure, data subject export and deletion, configurable retention periods, and audit logging of processing activity.
Are call recordings and transcripts stored?: Transcripts and call metadata are retained per your organisation's retention policy and are readable only by members of that organisation. Recording can be disabled entirely, and sensitive fields can be redacted before storage.
Can we run a security review before purchasing?: Yes. We walk security and procurement teams through the architecture, RLS model, encryption approach and audit coverage, and provide a security packet on request via the contact form.