Security

Last updated May 1, 2026

This page describes how VoxWin AI protects your data and the data of your callers. It is intended to give you enough information to make an informed decision about using the service.

How we handle your data

All data transmitted to and from VoxWin AI is encrypted in transit using TLS 1.2 or higher. This includes data flowing between your browser and our servers, between our servers and telephony systems, and between our systems and the third-party services we use to deliver the product.

Data at rest — including account information, call transcripts, session tokens, and configuration data — is encrypted using industry-standard encryption on our database and storage infrastructure.

Call recordings and transcripts are retained for 90 days by default. You can request earlier deletion by contacting us at [email protected].

Authentication

VoxWin AI uses one-time code (OTP) authentication. There are no passwords stored. When you sign in, a 6-digit code is sent to your email address. The code expires in 10 minutes and can only be used once. Incorrect codes are limited to 5 attempts before the code is invalidated.

Sessions are maintained through a cryptographically signed, HTTP-only, secure cookie. Session tokens expire after 30 days. They cannot be accessed by JavaScript running on the page.

Access controls

The operator dashboard is served through a separate application layer from the public marketing site. API routes that handle authenticated actions require a valid session token on every request — there is no client-side route guarding without a corresponding server-side check.

Internal access to production data is limited to operational necessity. We do not use production data for development or testing.

Sub-processors

To deliver VoxWin AI, we use third-party providers in the following categories. We do not publicly disclose specific vendor names in this document, but a current list of sub-processors is available on request.

• Voice synthesis and conversational AI — processes call audio and generates AI responses
• Telephony and SMS — routes inbound calls and delivers text confirmations
• Calendar and email integration — Google Calendar and Gmail, as described in our Privacy Policy
• Payment processing — handles subscription billing; we do not store card numbers
• Transactional email delivery — sends OTP codes, call transcripts, and booking confirmations
• Analytics — privacy-respecting analytics on the public website; no third-party ad tracking
• Cloud infrastructure and hosting — servers, database, and storage

All sub-processors are bound by data processing agreements and are required to maintain appropriate security standards.

Reporting a security issue

If you believe you've found a security vulnerability in VoxWin AI, please contact us at [email protected] before disclosing it publicly. We will respond within one business day and work with you to address the issue responsibly.