Security & Compliance

• Per-tenant isolation. Every record is scoped to a tenant and enforced at the database layer with row-level security, so one customer's data is not reachable from another's session.
• Encryption in transit. All traffic to the site, dashboard, and API is HTTPS. Webhook endpoints must be HTTPS.
• Identity through VoiceboxMD. Dashboard sign-in is delegated to the VoiceboxMD account system; we do not store your password.
• Hashed API keys. API keys are stored only as a SHA-256 hash with a short lookup prefix. The full key is shown once at creation and cannot be recovered — only revoked.
• Signed webhooks. Every delivery carries an HMAC-SHA256 signature over a timestamped payload so you can verify authenticity and reject replays. Delivery targets are restricted to public HTTPS addresses.
• Audit trails. Escalations record every attempt — who was called, when, and the outcome — which healthcare customers can use as a record of after-hours handling.
• Least data by design. The assistant is instructed to collect only what is needed to take a message or route a call, and to answer only from content you approve.

For customers that are covered entities, we act as a business associate and will sign a Business Associate Agreement. The assistant never gives medical advice, keeps conversations to scheduling and general information, and captures minimal protected health information.

An honest note:there is no such thing as being “HIPAA certified.” HIPAA compliance depends on your entire environment — your policies, your staff, your other vendors — not on any single product. We provide HIPAA-aligned design and a signed BAA; the obligations remain shared. See our HIPAA page.

The service can record and transcribe calls. Recording law varies by state: several require the consent of every party, not just one. Deciding what disclosure your callers need, and putting it in your greeting, is your responsibility as the business receiving the calls. Your greeting is fully editable in Settings for exactly this reason. We cannot give legal advice on which rule applies to you.

These providers process data on our behalf:

Customers under a BAA may request the current list and its status at any time.

The assistant answers from your knowledge base and the live conversation. We do not use your call content or knowledge-base content to train our own models, and our model provider processes it only to generate a response for that call. The assistant is instructed never to invent details — if your content doesn't answer a question, it says so and offers to take a message.

• We are not SOC 2, ISO 27001, HITRUST, or PCI certified, and we do not claim to be.
• We do not claim “HIPAA certification” — no such certification exists.
• We do not guarantee uninterrupted call handling; telephony and third-party providers can fail.
• The assistant is not a medical device, triage system, or emergency service. Callers with emergencies are directed to dial 911.

If a certification is required for your procurement, tell us and we will be straight about where we stand.

If you believe you have found a security issue, email hello@voiceboxmd.com with details and steps to reproduce. Please give us a reasonable opportunity to remediate before public disclosure. We do not pursue researchers who report in good faith and avoid privacy violations and service disruption.