Is Televox HIPAA compliant?

Not yet. HIPAA requires a signed Business Associate Agreement (BAA) and specific technical safeguards we are implementing. BAA is on our Enterprise roadmap. If HIPAA compliance is a hard requirement for your deployment, contact us to discuss your timeline and we'll tell you honestly where we stand.

Where is my data stored?

Call recordings, transcripts, and workspace data are stored in Supabase (hosted on AWS us-east-1). If you need a different region or data-residency guarantee, contact us — we're investigating multi-region support.

Can I disable call recording?

Yes. Recording is a per-workspace setting in your dashboard. When disabled, no audio is stored — only the transcript and the per-turn latency metadata. You can also permanently delete any individual recording from its call page at any time.

How do you handle my customers' personal data (names, phone numbers)?

Lead data captured by the AI (name, phone, stated intent) is stored in your workspace's lead table, scoped by RLS to your account. We do not sell or share this data. The AI does not transmit caller data to third parties other than the services required to run the call (Twilio, Deepgram, OpenAI, Cal.com, your configured webhook endpoints).

How are webhooks secured?

Every outbound webhook payload is signed with HMAC-SHA256. The signature is sent in the X-Televox-Signature header. Your endpoint can verify it using the per-workspace signing secret available in your dashboard. We also send an idempotency key so you can safely deduplicate retried deliveries.

What happens if I think there is a security issue?

Email security@televox.ai with "SECURITY" in the subject line. We acknowledge within 24 hours and commit to a full response within 72 hours for confirmed vulnerabilities. We do not currently have a public bug bounty programme, but we will work with you in good faith.

Security

Security that earns your trust — not just claims it.

We tell you exactly what controls are in place today, what is on the roadmap, and what we don't have yet. No compliance badges we haven't earned.

RLS on all dataHMAC webhooksTCPA-safeEncrypted at restTLS in transit

Controls in place today

What we've built into every layer.

These are not optional add-ons or enterprise gates. Every Televox workspace has these controls from day one.

Data isolation

Row-level security on every table

Every Supabase table has RLS policies enabled. Workspace data is scoped to the authenticated workspace ID at the database layer — not just the application layer. A misconfigured API route cannot expose another tenant's data.

Webhook integrity

HMAC-signed outbound webhooks

When Televox sends a webhook to your CRM or integration endpoint, the payload is signed with HMAC-SHA256 using a per-workspace secret. Your receiver can verify the signature before trusting the payload — the same model Stripe and GitHub use.

Inbound auth

Twilio signature validation

Every inbound SIP/PSTN request from Twilio is validated against the X-Twilio-Signature header using your account's auth token. Spoofed or replayed requests are rejected before reaching business logic.

Network security

SSRF guard

Webhook delivery is restricted to public, non-RFC-1918 IP ranges. Loopback (127.x), link-local (169.254.x), and private (10.x / 172.16–31.x / 192.168.x) addresses are rejected. This prevents your webhook endpoint from being used to probe internal infrastructure.

Abuse prevention

Rate limiting

API endpoints are rate-limited by workspace and IP. Burst allowances accommodate legitimate spikes while protecting the platform from abuse. Limits are enforced at the edge before requests reach application code.

Data control

Recording controls

Call recording is configurable per-workspace. When enabled, recordings are stored encrypted at rest in Supabase Storage with access scoped to the workspace. Recordings can be disabled entirely for compliance-sensitive deployments.

Compliance status

What we have. What we don't. No asterisks.

We believe the most trustworthy thing we can do is be explicit. Here is the full status.

✓ In place today◷ On the roadmap– Not yet

✓
Row-level security (RLS) on all dataActive on every table, enforced at database layer
In place
✓
Encrypted data at restSupabase storage — AES-256
In place
✓
TLS in transitAll connections, including LiveKit WebRTC and SIP signalling
In place
✓
HMAC webhook signingSHA-256 signature on every outbound webhook payload
In place
✓
TCPA-safe outbound controlsAI self-ID, DNC, calling-window enforcement
In place
✓
Per-workspace recording controlsEnable / disable per workspace; encrypted at rest
In place
◷
SOC 2 Type II certificationOn our roadmap — not yet certified
Roadmap
◷
HIPAA BAAEnterprise only, once available — roadmap, not yet available
Roadmap
◷
Penetration test reportPlanned for Q3 2026 — not yet conducted
Roadmap
–
GDPR Data Processing AgreementUS-focused product — EU DPA not yet in place
Not yet

Honest note:SOC 2, HIPAA BAA, and penetration test are on our roadmap for 2026. If these are hard requirements for your deployment today, we are likely not the right choice yet — and we'd rather tell you that up front.

Outbound calling

TCPA-safe by default.

Outbound campaigns ship with four mandatory controls. They can be customised but not disabled — the AI always identifies itself, and calling windows are always enforced.

AI self-identification

The agent introduces itself as an AI assistant on every outbound call. The script is enforced at the system-prompt level — agents cannot be instructed to claim they are human.

Do-Not-Call list enforcement

Outbound campaigns check your configured DNC list before dialling. Numbers on the DNC list are skipped with a logged reason. You are responsible for maintaining the accuracy of your DNC list.

Calling-window enforcement

Campaigns run only within the time window you configure per workspace (default: 8 AM – 8 PM local time per the called party's area code). Calls outside the window are queued, not dropped.

Campaign audit log

Every outbound attempt is logged — dial time, outcome, agent turn count, actions fired, and the AI's self-ID transcript confirmation. The log is available in your dashboard for 90 days.

Important: Televox provides technical controls, not legal advice. TCPA compliance depends on your consent model, use case, and jurisdiction. Consult legal counsel before running outbound campaigns, especially in healthcare or financial services.

Found a security issue?

Email security@televox.aiwith "SECURITY" in the subject. We acknowledge within 24 hours and aim to respond fully within 72 hours.

FAQ