Security & Data Handling

Controls you hold

These are settings in the product, not promises about our operations. A workspace admin can open each one today.

• Your own AI key. Voxonow holds no AI credentials and pays for no model usage. Until an admin adds a key for Anthropic, OpenAI or Google, no message ever reaches an AI provider. When they do, usage is billed to that account and the data passes under that account's terms — which for an organisation means its own agreement with a provider it already reviewed, rather than ours.
• Per-channel AI exclusion. Any channel, including a direct message, can be withheld from every AI feature. An excluded channel stays fully readable and searchable in the product; its messages are simply never sent anywhere. The filter runs in the database query rather than after it, so a body that is excluded is never selected in the first place.
• Activity log. Workspace settings shows who invited whom, who removed a member, who deleted a message, and who muted or removed someone from a call. Scoped to your workspace and to your own administrators' actions.
• Data export. Any person can download everything their account holds from Settings → Account, as one JSON file, with no request to us and no waiting period.
• Retention. This deployment can be configured to delete messages, call transcripts, audit records, webhook payloads and cached link previews past a set age — each on its own window, so speech can expire sooner than chat. Unset means kept indefinitely; nothing ages out by surprise.

How data is protected

• In transit: TLS everywhere, including the WebSocket connection and the media path.
• Passwords: hashed with Argon2. Session, reset and invite tokens are stored only as hashes, so a copy of the database cannot be used to log in as anyone or to redeem an invitation.
• Credentials we hold for you: AI provider keys and integration tokens are encrypted at rest with AES-256-GCM. The plaintext is reconstructed only at the moment a request is made, and is never returned by any endpoint — the settings screen shows the last four characters and nothing more.
• Backups:encrypted with AES-256-CBC and a PBKDF2-derived key (200,000 iterations) before they leave the server. Each night's ciphertext is decrypted back and verified as a readable dump before upload, because a backup that cannot be opened is not a backup.
• Error reports: message bodies, search terms, request bodies and email addresses are stripped before an error leaves our server for the error tracker.

Who can read what

• Direct messages are visible only to their participants. That boundary is enforced separately in message reads, in search, and in the AI retrieval path — three places, so one path cannot quietly become the exception.
• Workspace administrators manage members, channels, integrations and the AI key. There is no endpoint that lets an administrator read a direct message they are not part of.
• We operate the servers, so we can technically reach the database. Nothing in the product is built to: our own platform-admin tools deliberately expose workspace structure and counts, and no message content at all. Message bodies are stored unencrypted because that is what makes search work — Voxonow is not end-to-end encrypted, and we would rather say so than imply otherwise.

Calls

There is no recording feature. Nobody can press record, no call is kept as audio, and nothing in the product lists, plays or exports one. On most calls audio is relayed live and never written to disk at all.

No audio is written to disk on this deployment. Speech is transcribed by each person's own browser and only the text is sent to us. The software supports capturing audio to transcribe it on the server — for browsers that have no speech recogniser, such as Firefox — but that is switched off here, so a call held in one of those browsers simply has no transcript.

Speech is transcribed to text, on the speaker's own device. Each participant's browser runs the speech recogniser their operating system already ships, over their own microphone only, and sends the resulting text. Nothing is sent to a transcription service and there is no speaker separation to get wrong: the server records each line against the authenticated account that sent it and ignores any speaker the client claims. It is best-effort — Chrome and Safari can do it, Firefox cannot — so a call may end with no transcript.

Transcripts are stored as text, readable and searchable by members of that workspace, and deleted with the call or the workspace — or automatically, where a retention window is configured for them. What a finished call leaves behind is its own entry in the channel: who was there, how long, and — if the workspace has AI enabled — a summary drawn from the transcript and the text chat around it.

Where data goes

The full list of processors, what each one receives, and what a cross-border transfer means under Turkish law is in the Privacy Policy. In short: voice relay, email delivery, error tracking, object storage, encrypted backups, and — only if your admin configured a key — one AI provider of your choosing.

What we do not have yet

Stated plainly, because a reviewer finds these out anyway and it is better they read them here.

• No SSO or SAML. Sign-in is email and password, or Google. An organisation that requires directory-based access control should wait for it.
• No uptime guarantee. There is no SLA at this stage, and the terms say so.
• No third-party security audit. Nothing on this page has been verified by anyone outside the project.
• Not end-to-end encrypted. See “Who can read what” above.
• Young product, small install base. If your evaluation depends on a long operating history, this is not that yet.

Reporting something

If you find a vulnerability, write to security@voxonow.com before disclosing it publicly. We will confirm receipt and tell you what we find.

Questions about any of the above: privacy@voxonow.com.

Voxonow is operated by Voxonow Yazılım, the data controller (veri sorumlusu) named in the Privacy Policy.