Security & Trust

All traffic to Voxinity AI is encrypted in transit using TLS 1.2 or higher. Customer data, call recordings, transcripts, and stored OAuth tokens are encrypted at rest using AES-256 on the underlying managed storage layer. Database connections are authenticated and run over private network paths.

We follow the principle of least privilege: production credentials, signing keys, and database secrets are provisioned into a managed secret store and rotated regularly. Application code accesses these secrets via short-lived environment-scoped references — they are never committed to source control.

Internal access to production systems is restricted to a small, named group of engineers via SSO and multi-factor authentication. All administrative actions are logged.

Within the product, workspaces support role-based access (Owner, Admin, Moderator, Viewer). Every API request is authenticated with a short-lived bearer token and checked against the requesting user's workspace and sub-account membership.

Workspace owners can review recent access events — invites, permission changes, removals — under Settings → Members → Recent Activity.

Voxinity AI integrates with LeadConnector, Twilio, Telnyx, ElevenLabs, Stripe, OpenAI, Anthropic, and Google. We request the minimum OAuth scopes required to operate the AI agent and keep your CRM in sync (see theCRM Data Usage tablefor the complete list of LeadConnector resources we touch).

When you uninstall the Voxinity app from your LeadConnector sub-account or click Disconnect in the Voxinity dashboard, we:

• Revoke the stored OAuth access and refresh tokens.
• Halt every background sync loop for that sub-account.
• Delete the LeadConnector connection record and flip the integration card to Disconnected.
• Stop charging any LeadConnector-dependent usage for that sub-account.

The uninstall webhook signature is verified using LeadConnector's published Ed25519 public key before any state mutation occurs.

Telephony (Twilio, Telnyx) and voice synthesis (ElevenLabs) credentials are supplied by the customer and stored encrypted against the customer's sub-account. Voxinity AI never charges a markup on third-party API spend, and you can revoke or rotate any BYOK credential from the dashboard at any time.

We publish live availability for the Voxinity AI platform and our critical sub-processors at voxinity.ai/status. Telephony, LLM inference, and database health are monitored independently. Operators can subscribe to incident alerts from the status page.

A complete list of sub-processors and the data each one handles is published in our Privacy Policy. We will notify workspace owners at least 30 days in advance before adding a new sub-processor that materially changes how data is processed.

Our on-call engineers are paged on production alerts. In the event of a confirmed security incident affecting customer data, we will notify impacted workspace owners by email within the timeframe required by applicable law (and in any case without undue delay), describe the nature of the incident, the data involved, and the remediation steps taken.

We welcome reports from independent security researchers. If you believe you have found a security issue in the Voxinity AI platform, please email security@voxinity.ai with a description of the issue, reproduction steps, and any proof-of-concept material. We commit to:

• Acknowledge receipt within 2 business days.
• Investigate and triage promptly.
• Coordinate a remediation timeline and disclosure window with you.
• Not pursue legal action against good-faith researchers who follow this policy.

Out of scope: automated scanner output without manual validation, social engineering against Voxinity AI staff or customers, denial-of-service testing, physical attacks, and anything that would impact other customers' data.