Last updated May 25, 2026
VoiceCraft is built with a defense-in-depth security model. Security controls operate at the transport layer, the application layer, the data layer, and the infrastructure layer independently so that a failure in one layer does not expose customer data.
Key principles that guide our security posture:
This page is the authoritative technical reference for security measures referenced in our Data Processing Addendum and Privacy Policy.
All communication between browsers, the VoiceCraft server, and sub-processor APIs is encrypted in transit using TLS. Plain HTTP is not accepted on any production endpoint.
In production, all authenticated session cookies are flagged httpOnly and secure, preventing JavaScript access and ensuring cookies are only transmitted over HTTPS connections.
HTTP Strict Transport Security (HSTS) is enforced in production environments, including for all API subdomains.
VoiceCraft supports email and password authentication and Google OAuth. Passwords are hashed using an industry-standard adaptive hashing algorithm. No plaintext passwords are stored or transmitted.
Session tokens are signed JWTs stored in httpOnly, secure, sameSite=Lax cookies in production and are not accessible to JavaScript.
Authentication endpoints are rate-limited per IP address and per account to prevent abuse. This includes forgot-password requests, password reset submissions, and email verification code resends.
VoiceCraft platform staff who require access to customer data or the ability to impersonate a customer organization must complete a WebAuthn passkey step-up authentication before any privileged action is permitted.
The elevation credential granted after step-up has a short, non-renewable lifetime. Platform role assignments are validated against the database on each privileged request, so revocations take effect promptly.
Every impersonation session start and stop is recorded in both the AuthEvent table and the AuditLog table, capturing the actor staff ID, the target organization ID, the reason provided, and the timestamp.
Integration tokens for Google Calendar, Microsoft, HubSpot, Square, and Clover are encrypted at rest using AES-256 before being stored in the database. The master encryption key is sourced from the server environment and never persisted alongside the ciphertext.
The encryption scheme is versioned to support key rotation without requiring re-authorization of existing integrations. Old key versions are retained until all tokens encrypted under that version have been re-encrypted or revoked.
Every API route that returns or modifies customer data is protected by session guards that enforce organization-scoped access. The guards (requireOrg and requireRole) are applied at the route handler layer and cannot be bypassed by application-level code.
Webhook routes that do not have a user session are scoped by agent phone number or template owner, verified against the database before any data is read or written.
There is no shared data path, shared cache key, or shared query result across tenants. Row-level isolation is the default for all customer data models including agents, calls, transcripts, forms, orders, and integrations.
All inbound webhook routes verify cryptographic signatures from the calling provider before processing any request. Unverified requests are rejected before any side effects are executed. Each provider uses its own published signing mechanism (HMAC, JWT, or equivalent), and VoiceCraft implements the verification approach specified in that provider's official documentation.
Internal webhooks between VoiceCraft services use a shared-secret HMAC scheme with the VOICECRAFT_API_KEY environment variable.
When the voice agent's language model invokes a tool (book appointment, send SMS, process order, etc.), the raw tool arguments are redacted before being persisted to the database. This prevents callers' personally identifiable information from being visible in the operator dashboard or in any downstream data export.
Redaction rules applied before persistence:
Raw tool arguments are available only to the voice agent runtime for the duration of the call and are not stored in any persistent medium after the call ends.
Call recordings and knowledge documents are stored in separate Cloudflare R2 buckets, namespaced by agent ID to enforce per-agent isolation within a bucket.
Knowledge document uploads are validated for file type (PDF, DOCX, TXT, and Markdown) and size before being accepted.
All R2 read operations issue short-lived presigned URLs after an authorization check confirms the requesting user belongs to the agent's organization. Presigned URLs are not cached or reused across requests.
When an agent is purged, a sweep of the recordings/<agentId>/ prefix deletes all associated recordings from R2. Knowledge documents are deleted as part of the same purge operation.
VoiceCraft maintains two complementary audit channels:
Records authentication and privileged-action events including login, Google OAuth, password reset, email verification, impersonation start/stop, WebAuthn passkey enrollment and assertion, and platform role elevation. Each event captures IP address, user-agent, approximate geolocation, and outcome.
Records sensitive data operations including form submission reads, list exports, and tombstone (soft-delete) actions, PHI access events, WhatsApp template edits, and catalog changes. Each entry captures the actor ID, action type, before/after snapshots where applicable, and a timestamp.
Both audit channels are retained indefinitely and are not subject to automatic purge.
PostgreSQL backups are managed by VoiceCraft's database hosting provider with point-in-time recovery enabled. Backup retention and recovery time objectives are governed by the provider's SLA.
Cloudflare R2 buckets for recordings and knowledge documents do not have an automated lifecycle deletion policy configured at the storage layer. Deletion is application-driven and occurs as part of the agent purge process or explicit customer data deletion requests.
VoiceCraft's sub-processors are listed publicly at voicescraft.app/subprocessors. Sub-processors are selected based on their stated security and privacy commitments and are contractually bound to process Customer Data only on VoiceCraft's instructions.
Sub-processors do not use Customer Data for their own marketing, analytics, or model training unless the Customer has separately agreed to such terms directly with the sub-processor.
VoiceCraft does not integrate any third-party analytics, behavioral tracking, session-replay, or error monitoring scripts. The following tools are explicitly not present on VoiceCraft pages:
The only external script loaded by VoiceCraft is the Helpnest help-center widget on authenticated dashboard pages, and only when the operator has configured the relevant environment variables. See /cookies for full details.
Our Privacy Policy is enforceable, not aspirational. The absence of tracking is a technical property of the deployment, not a policy statement that can be silently revoked.
VoiceCraft is not currently SOC 2 certified. We are working toward SOC 2 Type I and will update this page when the audit is complete.
VoiceCraft maintains HIPAA-aware infrastructure: provider routing directs AI and STT traffic to BAA-eligible sub-processors when an organization's HIPAA flag is set, healthcare vertical detection gates PHI-sensitive form field handling, and BAA relationships are tracked per sub-processor. However, the HIPAA program is not yet open to general customers. Please contact sales@voicescraft.app for BAA availability. Customers must not transmit PHI until HIPAA mode is explicitly enabled for their organization.
VoiceCraft is not PCI-DSS certified and does not need to be. Payment data is handled exclusively by Stripe via Stripe-hosted checkout flows and never touches VoiceCraft's infrastructure. Stripe is PCI-DSS Level 1 certified.
To report a security vulnerability in VoiceCraft, contact us at security@voicescraft.app. A machine-readable disclosure policy is published at /.well-known/security.txt per RFC 9116.
Please include:
VoiceCraft does not currently operate a paid bug bounty program. We commit to acknowledging all legitimate reports within 5 business days and providing status updates as the issue is investigated and remediated.
We ask that you practice coordinated disclosure and not publicly disclose vulnerabilities until we have had a reasonable opportunity to investigate and remediate the issue.
For SOC 2 reports, penetration test summaries, and other security artifacts available under NDA, contact us at security@voicescraft.app.
We are evaluating a hosted trust portal (Vanta, Drata, or SafeBase) for self-service access to security documentation in 2026. This page will be updated when a portal is available.