Trust & security
Voice Matters security — accounts, calls & control plane
How Voice Matters protects accounts, call intelligence, and the control plane your team relies on every day.
Security overview · not a formal audit report
Transport & storage
TLS for data in transit. Secrets and API keys stored server-side with restricted access. Passwords hashed with modern algorithms — never stored in plain text.
Account security
Session-based auth with refresh rotation. Forgot-password and reset-password flows use single-use, time-limited tokens. Resets invalidate existing sessions.
Access control
Authenticated APIs for projects, agents, workflows, and call data. Rate limiting on auth endpoints to reduce brute-force and abuse risk.
Operational hygiene
Structured logging, error boundaries, and environment-separated configuration. Production deployments use reverse proxies and hardened service defaults.
Practices
What we do by default
- Least-privilege service accounts for infrastructure where applicable
- Dependency updates and containerized services for consistent deploys
- No card data stored on our servers — handled by payment processors
- Customer call data scoped to your account and projects (and team seats you invite)
- Workspace export and account/project deletion tools where available in the product
- Call recordings and transcripts kept until you delete them or close the account — no self-serve auto-retention or legal-hold UI yet
- Dev-mode reset links only when email delivery is not configured
Report an issue
Responsible disclosure
If you believe you have found a vulnerability, email security@voicematters.cloud with steps to reproduce. Please give us reasonable time to investigate before public disclosure.