Voxe Desk · Trust Center
Security and privacy, stated honestly
Voxe Desk handles customer conversations, knowledge bases, and connected business data — so security is not optional. This page describes exactly where we stand today: what we do, what we can share, what we are building toward, and what we do not yet have.
Last reviewed: September 9, 2026
[email protected]Security overview
The controls currently implemented in the product and our operations.
Application & infrastructure
- All traffic is encrypted in transit with HTTPS/TLS
- Integration credentials and OAuth tokens are encrypted at rest (AES-256)
- API rate limiting protects authentication and public endpoints
- Error and reliability monitoring (Sentry) — session replay disabled
Account & access
- Passwords are hashed with bcrypt and never stored in plaintext
- Optional two-factor authentication (TOTP)
- OAuth sign-in supported
- Sessions are revoked on password reset
- Role separation between user and administrative access
Data & privacy
- Customer data is scoped to the owning account
- Payments are processed by Stripe — full card numbers never touch our servers
- We do not sell personal information
- Data deletion on request, as described in our Privacy Policy
- Cookie consent management on the production website
AI safety
- Data is sent to AI providers only when needed for the selected feature
- Voxe does not train foundation models on your data
- Human handoff is built into every AI conversation flow
- AI providers and models are configurable per workspace
Deployment options
- Managed cloud deployment, or self-hosted on your own infrastructure
- Self-hosted deployments keep customer data entirely within your environment
Operations
- Security-relevant events are logged and monitored
- Suspected account compromise handled via a dedicated support process
- Vulnerability reports are reviewed and acknowledged — email us directly
Documents
Everything is labeled by its real status: published, available on request, in progress, or not currently available.
Published now
Privacy Policy
What we collect, why, who we share it with, and your rights.
ViewCookie Policy
Cookies, browser storage, and similar technologies we use.
ViewTerms of Service
The agreement governing use of the Voxe Desk services.
ViewRefund & Cancellation Policy
Billing, cancellation, and refund practices.
ViewSubprocessor list
Independent external service providers that may process data for Voxe, and why.
ViewAvailable on request
These documents exist and are maintained as part of our internal security and privacy program. We review every request manually and reply by email; some documents may require a mutual NDA.
Information Security Policy
Our internal security policy: objectives, roles, and core controls.
Access Control Policy
How accounts, credentials, and privileged access are managed.
Encryption Policy
Encryption standards for data in transit and at rest.
Data Retention & Disposal Policy
How long data is kept and how it is deleted.
Incident Response Procedure
How we detect, respond to, and communicate about incidents.
Business Continuity Overview
How we plan for outages and recovery.
AI Ethics & Transparency Policy
The principles governing our use of AI systems.
Security questionnaire
We complete your standard vendor or security questionnaire.
In progress
Data Processing Addendum
A standardized DPA template is being finalized. Today, data-processing terms are agreed individually — request one and we will follow up.
SOC 2 alignment
We are mapping our controls to SOC 2 criteria as we build toward a future audit. We do not have a SOC 2 report and none is available yet.
Not currently available
We would rather tell you clearly what we do not have than imply otherwise. Registering interest genuinely shapes what we build next.
ISO 27001 certification
We are not ISO 27001 certified. Our internal policies follow its structure, but no certification exists.
Independent penetration test report
No third-party penetration test report is available yet. Interest registered here helps us prioritize one.
HIPAA BAA
We do not offer Business Associate Agreements, and the services are not intended for protected health information.
Request access
Tell us who you are and what you need. A person reviews every request and replies from [email protected], typically within a few business days.
Systems we operate
These components are part of the Voxe platform and are developed, deployed, and maintained within Voxe/MCP4-operated infrastructure. They are not independent external subprocessors. Customer data processed by these systems remains within infrastructure operated for Voxe, subject to your deployment and configuration. On managed deployments, PostgreSQL and Redis also run as self-hosted services inside that same production environment.
| System | Role |
|---|---|
| Fusion | Voxe/MCP4-operated AI orchestration infrastructure used to route and control model requests within our platform. |
| Voxe Workflow Engine | Voxe-operated workflow infrastructure that we maintain. |
| VoxeDesk | Voxe-operated helpdesk infrastructure used for shared inboxes, agent handoff, and related support workflows. |
Separately, a customer may connect their own external helpdesk or other tools. Those customer-directed integrations are not the same as VoxeDesk or the other systems listed above.
Subprocessors
Independent external service providers that may process data for Voxe in connection with the Services, depending on deployment and configuration. Managed production application hosting runs on DigitalOcean; Cloudflare provides network, DNS, TLS, Tunnel, and security infrastructure. This list does not include Voxe/MCP4-operated platform systems (Fusion, Voxe Workflow Engine, VoxeDesk) or self-hosted PostgreSQL/Redis described above. Each provider receives only the information reasonably necessary for its function — see our Privacy Policy for details.
| Provider | Purpose |
|---|---|
| DigitalOcean | Production application hosting (VPS / compute) and related infrastructure for managed deployments |
| DigitalOcean Spaces | Object storage for uploaded files and media |
| Cloudflare | Network, DNS, TLS, Tunnel, and security infrastructure |
| OpenAI | AI model processing for AI-generated responses and embeddings |
| OpenAI Ads | Advertising attribution and signup/trial conversion measurement |
| Jina AI | Fallback webpage scraping and content extraction |
| Stripe | Payment processing, subscriptions, checkout, billing portal, and top-ups |
| Google (Gmail SMTP) | Transactional email delivery |
| Google OAuth | Account authentication and sign-in |
| Google Calendar | Customer-enabled calendar scheduling integration |
| Sentry | Error, security, and performance monitoring |
| CookieYes | Cookie consent management |
| ReferralRocket | Referral and affiliate attribution |
| Formspree | Contact form processing |
Not every provider is used on every page, plan, or deployment. Self-hosted deployments may use a different set of providers under your control. This table is not a complete inventory of every system involved in hosting or processing.
AI & data handling
What gets sent to AI providers
Depending on the feature: prompts, conversation history, page context, system instructions, knowledge-base content, retrieved business data, and tool results. Data is sent only when reasonably necessary for the selected feature or workflow.
What we do not do
We do not train foundation models on your data, and we do not sell personal information. Provider-side retention and training practices vary by provider and configuration; we do not claim they are identical across providers.
Your controls
You choose which integrations to connect and which AI features to enable, can configure page-context fields on your widget, and human handoff is always available. Self-hosting keeps data on your own infrastructure.
Compliance roadmap
What we are actively working toward. None of these are certifications we hold today.
SOC 2 alignment
We are mapping our existing controls to SOC 2 criteria and closing gaps as we build toward a future audit. No report exists yet.
Standardized DPA
A standard Data Processing Addendum template customers can sign without negotiation. Until it ships, data-processing terms are agreed individually.
Independent security testing
A third-party penetration test is on our roadmap. Interest registered through the request form directly influences when we prioritize it.
Frequently asked questions
Are you SOC 2 or ISO 27001 certified?
No. We do not currently hold SOC 2, ISO 27001, or similar certifications, and we will not imply otherwise. Our internal security policies follow the structure of these frameworks, and we are aligning our controls with SOC 2 criteria as we build toward a future audit. When a certification is achieved, it will be published here.
Will you sign a Data Processing Addendum (DPA)?
Data-processing terms are currently agreed individually with customers who need them. A standardized DPA template is being finalized — request one through the form above and we will follow up.
Where is my data hosted?
On managed deployments, the application runs on DigitalOcean VPS infrastructure. Cloudflare provides network, DNS, TLS, Tunnel, and security infrastructure in front of the application. Application databases (PostgreSQL) and caching (Redis) are self-hosted within that Voxe production environment—not separate managed database vendors. Customer data is also processed within Voxe/MCP4-operated platform systems (including Fusion AI orchestration, the Voxe Workflow Engine, and VoxeDesk) and by the independent external providers listed in the subprocessor table when those services are used. That table lists independent external providers; it does not list internally operated software components. If you self-host Voxe, customer data stays on infrastructure you control.
Is my data used to train AI models?
Voxe does not train foundation models on customer data. AI features send data to the configured model providers only as needed to perform the selected function; each provider's data-use and retention practices are governed by that provider relationship, as described in our Privacy Policy.
Can you complete our security questionnaire?
Yes. Submit a request through the form above with your questionnaire or format, and we will complete it.
How do I report a security vulnerability?
Email [email protected] with the details. Please do not include sensitive customer data in the report. We review and acknowledge every report.
Built with practical security controls
Voxe Desk maintains technical security controls, published privacy and security policies, and an active internal security program. We are continuing to formalize our compliance program as the platform grows. We do not currently claim certifications such as SOC 2 or ISO 27001; the details on this page describe what we can verify today.
Questions we did not answer?
Email [email protected] for security, privacy, or compliance questions, or use the request form above.
Voxe Desk is a registered assumed name of a Texas limited liability company. The information on this page describes our practices as of the date shown above and is provided for transparency; it does not modify the Terms of Service or any signed agreement.