Skip to content
Trust & governance

Security & compliance

Enterprise-grade controls for AI voice workflows — encryption, access management, retention policies, and transparent subprocessors.

Talk to enterprise sales System status
SOC 2 aligned practices
99.9% uptime target
Role-based access
Configurable retention

SOC 2 Type II

VoxBridge follows SOC 2 Type II–aligned controls: least-privilege access, encryption in transit (TLS), immutable audit logging, change management, and documented incident response. Control matrix and bridge letter are available in the trust center below upon request.

  • Admin and client session timeouts
  • Password policy enforcement
  • Login lockout after failed attempts
  • Optional two-factor authentication (TOTP)

HIPAA & health care

HIPAA-ready workflows with executed Business Associate Agreement (BAA) available on Enterprise. PHI redaction, transcript access audit logging, and configurable retention are enabled in the client dashboard when your account is configured for regulated workloads.

See health care case study →

Debt collection & FDCPA

Script guardrails, disposition tracking, and human handoff on promise-to-pay. Agents support compliant opening disclosures when configured in your agent prompts.

See collections case study →

Logistics & operations

24/7 driver check-in, exception capture, and webhook delivery to your TMS. Retention and access controls apply to operational call data the same as any vertical.

See logistics case study →

Data retention & purge

Each organization sets call data retention (default 90 days, configurable 30–365 days). Automated purge jobs remove expired transcripts and media per org policy.

PCI DSS

PCI DSS SAQ A attested. Payment card data is tokenized by Stripe; VoxBridge does not store PAN or CVV. Hosted checkout scope only.

Encryption & key management

TLS 1.2+ for all public endpoints. Secrets and SMTP credentials encrypted at rest. Database credentials isolated per deployment.

Access control

Role-based access control, session timeouts, login lockout, optional TOTP MFA, and admin audit logging on sensitive operations.

Incident response

Documented detection, containment, customer notification, and recovery procedures. Error monitoring via optional Sentry/GlitchTip integration.

Business continuity

Automated nightly database backups, restore runbooks, and configurable RPO/RTO targets for production deployments.

Subprocessors

We use vetted providers for infrastructure and delivery. You configure credentials for your deployment:

  • Cloud hosting & PostgreSQL (your region)
  • Stripe — billing & payouts
  • LiveKit — real-time voice media
  • Telnyx or your SIP carrier — telephony & SMS
  • SMTP provider — transactional email
  • OpenAI Realtime — speech + LLM (voice worker)
  • Sentry — error monitoring (optional)

Trust center

Live compliance certifications and downloadable artifacts from the platform trust center.

Documents & policies