Back to home

Trust & Safety

Security

How we keep your data — and your callers’ data — safe.

Last reviewed: 1 June 2026

Security is a first-class concern at Voxelo. Our platform handles sensitive caller conversations, so we apply layered defences at every level of the stack.

Infrastructure

All production infrastructure runs on South African-hosted servers (Xneelo), keeping your data within the Republic of South Africa and subject to POPIA. Our architecture uses separate compute and storage environments per tenant — no data co-mingling between customers.

  • Physical data centres with 24/7 security, CCTV, and biometric access.
  • Automated daily backups with 30-day point-in-time recovery.
  • 99.9% uptime SLA with automatic failover.
  • DDoS protection and rate limiting at the network edge.

Encryption

  • In transit: TLS 1.3 for all API, dashboard, and telephony traffic. Older TLS versions and RC4 are disabled.
  • At rest: AES-256 encryption for call recordings, transcripts, and all database backups.
  • Key management: Encryption keys are rotated quarterly and stored separately from encrypted data.

Access Controls

  • Role-based access control (RBAC) within each tenant — Owner, Admin, and Member roles.
  • Multi-factor authentication (MFA) enforced for all Voxelo staff accounts.
  • Staff access to production systems is logged, time-limited, and requires approval.
  • Principle of least privilege: engineers only have access to systems required for their role.
  • All access to tenant data by Voxelo staff is logged with reason, reviewer, and timestamp.

Call Recording Security

Call recordings are encrypted at rest and stored in isolated per-tenant storage buckets. Access is restricted to the tenant’s authorised users. Pre-signed, time-limited URLs are used for playback — recordings are never served from a public URL. Tenants can configure automatic deletion after a set retention period (default: 90 days).

Application Security

  • All API endpoints are authenticated using short-lived JWT sessions via Auth.js / NextAuth.
  • Input validation and Zod schema enforcement on all external data (webhooks, forms, API).
  • SQL injection protection via Prisma ORM parameterised queries.
  • CSRF protection on all state-changing requests.
  • Dependency scanning with automated alerts for known CVEs.
  • Automated SAST scanning on every pull request.

POPIA Compliance

We have appointed an Information Officer as required by POPIA. Our data handling practices, sub-processor agreements, retention schedules, and breach notification procedures are designed to meet POPIA requirements. See our Privacy Policy and Data Processing Agreement for full details.

Incident Response

In the event of a confirmed data breach:

  1. We will contain the incident within 4 hours of discovery.
  2. We will notify affected tenants within 72 hours.
  3. We will report to the Information Regulator within 72 hours if the breach meets the threshold for mandatory reporting under POPIA.
  4. We will provide a full post-incident report within 14 days.

Penetration Testing

We conduct annual penetration testing by an independent third party. Results are remediated on a risk-prioritised basis. A summary report is available to Enterprise customers on request under NDA.

Responsible Disclosure

If you discover a security vulnerability in our platform, please report it responsibly to security@voxelo.co.za. We will acknowledge receipt within 2 business days, investigate promptly, and keep you informed. We do not take legal action against researchers who act in good faith.

Please do not access, modify, or exfiltrate customer data as part of testing.