Encrypted keys
Provider API keys, Stripe keys and agency email keys are encrypted with AES-256-GCM.
Security
How we look after your clients' data
Encrypted provider keys, data separated by agency, and passwordless sign-in. Inbound call data stays in your client's provider account.
- 14-day free trial
- No card needed
The controls in place
Row level security
Database row level security keeps every agency's data apart from every other agency's.
Passwordless sign-in
Everyone signs in with a one-time code sent by email, with rate limits and lockout after repeated attempts.
Audit logs
Admin actions and call deletions are logged, so you can see who did what.
Security headers
The app sends a Content Security Policy, HSTS, nosniff and frame-ancestors headers.
Where it runs
The app is hosted on Google Cloud Run, the database on Supabase and files on Cloudflare R2.
What is stored and what is read live
| Data | Where it lives |
|---|---|
| Inbound call recordings and transcripts | Stay in your client's ElevenLabs, Retell AI or Vapi account. The portal reads them from the provider when your client opens a page. |
| Outbound campaigns | Campaign records, lead lists and campaign calls are stored in the portal so you can track each campaign. |
| Provider API keys | Stored encrypted with AES-256-GCM, one per client workspace. |
| Branding and settings | Logos are stored on Cloudflare R2; workspace settings in the database, protected by row level security. |
The services we use to run Voice AI Portal are listed on the sub-processors page.
Report a vulnerability
If you think you have found a security issue, email hello@voiceaiportal.comwith the details and steps to reproduce it. Our contact details are also published insecurity.txt.
Policies
Questions agencies ask
Where does call data live?
Inbound call recordings and transcripts stay in your client's ElevenLabs, Retell AI or Vapi account. The portal reads them from the provider when someone opens a page and does not keep a copy.
Outbound campaign records are stored in Voice AI Portal so you can track each campaign. Provider API keys are encrypted with AES-256-GCM, and row level security keeps each agency's data apart.
How are provider API keys stored?
Each provider API key is encrypted with AES-256-GCM before it is stored. It is used only to read that client's data and to carry out actions your team takes, such as running a campaign or deleting a call.
Only the account owner and admins can add or update a key. Clients never see it.
Do clients see which provider I use or what it costs?
Your clients see your brand. Conversation pages in the client portal show neither the provider's name nor what the call cost. Your provider account and your provider bill stay between you and your provider.