SupabaseYour database and files
SOC 2 Type 2
Supabase encrypts the data at rest with AES-256 and in transit with TLS. Stored in the US (us-east-1).
Supabase's security page ↗Built on audited providers.
Retell AIThe AI on your calls and chats
SOC 2 Type 1SOC 2 Type 2
Retell AI has zero data retention agreements with the AI, speech and voice companies it uses.
Retell AI's security page ↗TwilioPhone numbers, calls and SMS
SOC 2 Type 2ISO/IEC 27001
Twilio carries your calls, recordings and SMS on your QuickVOC number.
Twilio's security page ↗StripeCard and bank payments
PCI DSS Level 1
Card numbers go to Stripe and never touch QuickVOC's servers.
Stripe's security page ↗ResendEmails to your customers
SOC 2 Type II
Resend sends your estimates, invoices and reminders from your company's name.
Resend's security page ↗HostingerThe servers QuickVOC runs on
ISO/IEC 27001:2022
Hostinger runs the data centers. We lock the server itself down (see below).
Hostinger's security page ↗QuickVOC itself has no audit report of its own yet. Each certification above belongs to the provider named on its card, and the link opens that provider's own page.
Our own locks, on top.
Each company sees only its own data
Row-level security is on for every table in the database, so one company's account can't reach another's records.
Encrypted on the way and at rest
TLS 1.2 or higher on every page and API call, AES-256 in the database.
Keys and tokens locked twice
Integration keys, bot tokens and SMS registration details are encrypted again with AES-256-GCM on our server.
No passwords to steal
You sign in with Google or a one-time code we email you.
Card numbers never touch QuickVOC
Customers pay on Stripe. We only see that the payment went through.
A locked-down server
Only the web and secure-shell ports are open, sign-in is by key only, password guessing is blocked and security updates install on their own.
Not used to train AI
Your call recordings, transcripts and messages are not used to train AI models.
AI assistants with limits
Claude or ChatGPT connected to QuickVOC can't delete anything, refund money or change settings. Anything that reaches a customer waits for your button.
Your data stays in the US
Your database and files are stored in the United States.
Found a security problem? Email us.
Security questions
Something else on your mind? Talk to us.
Is QuickVOC SOC 2 certified?
Not yet as a company: QuickVOC has no audit report of its own. Your data runs on providers that have one: Supabase and Retell AI (SOC 2 Type 2), Twilio (SOC 2 Type 2 and ISO/IEC 27001), Resend (SOC 2 Type II), Stripe (PCI DSS Level 1) and Hostinger (ISO/IEC 27001).
Where is my data stored?
In the United States. Your database and files are in Supabase's us-east-1 region.
Who can see my calls and customers?
Only people on your team. Within your account, only owners and admins can connect integrations and manage billing, and the database refuses requests from every other company's account.
Do you sell my data or use it to train AI?
No. We don't sell personal information, and your call recordings, transcripts and messages are not used to train AI models.
Can I keep patient health records in QuickVOC?
No. QuickVOC is not for patient health records (HIPAA). Dental offices use it for calls and scheduling, without symptoms or treatment details.
What happens if there is a security incident?
We log and watch our systems for errors and abuse. If an incident affects your data, we tell you without undue delay and as the law requires.