Security
How Voxera handles your keys and your callers' data
Your agents talk to your customers, using credentials you own. This page describes what the platform does about that — and, at the end, what it does not yet claim.
Three kinds of credential, one job each
A secret key lives on your server and does one thing: exchange itself for a short-lived session token. A publishable key is the one you ship inside a client, and is restricted to the origins you allow. A service key is for voice servers only. Present a secret key to the runtime and it is refused — once a credential has passed through a client it is no longer secret, and the platform treats it that way.
Provider keys are sealed, and never handed back
Your speech-provider key is encrypted with AES-256-GCM and bound to the connection row it belongs to. No API returns it to a person, and nothing in the agent configuration can hold one — inline API keys, tokens and passwords are rejected at both the console and the API, because agent config is readable by anyone who can read the agent.
A voice server sees one key, not your keyset
When a call starts, the voice server asks for the single credential the published agent version names, and the control plane checks that it is that one. A voice server cannot enumerate the rest of your workspace's credentials. The resolved key is held against that session alone and dropped when the call ends, on every exit path.
Call audio is not stored
Audio is transcribed as it passes through the pipeline and is not written to disk. Transcripts are deleted on the retention schedule your plan sets. Usage metering records counts — characters, minutes, call totals — never what was said.
Tenant isolation is enforced, not assumed
Workspace roles and platform roles are separate systems and are never conflated: a workspace role grants nothing outside that workspace, whatever its name. Every server action re-authorises against the control plane rather than trusting the browser, and access tokens, management keys and provider secrets never reach client-side code.
Consequential changes carry a reason
Suspending a workspace, overriding an entitlement and changing a platform role each require a written reason and are recorded in the audit log. Published agent versions are immutable — a change goes through a new draft that is compared against the live version and published explicitly, and a rollback re-publishes a previous version rather than rewriting one.
Plainly
What we do not claim
Stated here so you do not have to discover it during procurement.
Voxera holds no SOC 2, ISO 27001 or HIPAA certification today, and nothing on this page should be read as one. The controls above are things the platform does; they have not been audited by a third party.
There is no published uptime commitment or service-level agreement, as the terms of service say. Support is by email, answered on a best-effort basis.
If your deployment needs something listed here that does not exist yet, say so — get in touch and we will tell you straight whether it is on the roadmap or not.
Hear it before you build on it
The demo is the real pipeline, not a recording. Talk to it, interrupt it, and decide from there.