Experience CenterGo to Console

Voqalize / Resources

Security and trust

What we hear, and what we keep.

Your customers will tell your app things they would only say to a person: an account number, a symptom, a home address. Voqalize carries those words, so we treat every call as private.

Standards

The standards we meet.

Voqalize is certified for ISO/IEC 27001:2022, SOC 2, the GDPR and India’s Digital Personal Data Protection Act.

Certificates and audit reports are available on request. Please reach out to .

During a call

One sentence, start to finish.

Here is what happens to one thing your customer says, and who handles it along the way.

  1. Your customer speaks.

    The microphone opens when they start a call in your app.

  2. Encrypted in transit.

    Their voice travels to us over WebRTC, encrypted with DTLS‑SRTP.

  3. Heard by our speech servers.

    Speech becomes text on servers we operate. No outside speech company hears it.

  4. Answered by your AI agent.

    The words go to your agent, on your own servers, or to the one we run for you with Plug & Play. It decides what to say and what the app should do.

  5. Spoken back, and done.

    Your customer hears the answer, and the app moves the appointment.

How we treat conversations

Private by default, and kept to a minimum.

People say private things to a voice that sounds like it’s listening. So we keep as little as we can, and only what you choose to keep.

Everything a call touches

Voice
Carried between your customer’s device and our servers over WebRTC, encrypted with DTLS‑SRTP. Speech recognition and the agent’s voice run on speech servers we operate, so no outside speech company hears your customers. Audio is saved only when recording is on.
Camera and screen
Only when your app turns them on. Carried the same way as voice, and saved only when recording is on.
Transcripts
What your customer said and what your agent answered. They go to your AI agent with a signed token for that one session, so your agent can check the call came from us. We keep the session’s turns so you can review the call in the Console.
Recordings
Off by default. You can turn them on for an agent or for one call, and each call records which setting turned recording on, so you can still tell after you change the default. The upload goes through a signed link that can write that one file and nothing else.
The character
Drawn on your customer’s device from short cues such as listening, thinking and speaking. There is no video of the character to store.
Keys and access
Secret keys are shown once, and we store only a hash of them. Browser keys work only from the websites you list. Teammates are owners, admins or members, and changes to your account go into an audit log.
How long we keep it
Session data is kept for 30 days, then deleted. The demos on voqalize.com are never recorded.
Where it runs
Every Voqalize service runs on Google Cloud in the Mumbai region, and nowhere else.
Model training
We never use your customers’ audio, video, transcripts or recordings to train or improve speech or language models.

Talk to us

Get in touch about security.

Report a vulnerability

Write to with the subject “Security”. Tell us what you found and how to reproduce it, and give us a fair chance to fix it before you share it.

Request our security documents

Ask for our certificates and audit reports, or send us your security questionnaire. Tell us a little about your company and what you need.

To request them, please reach out to .