Security and privacy
How VoiceLens stores and protects call recordings and transcripts: isolation, access control, credentials, encryption in transit, retention and deletion, and what to tell your own security team.
Call recordings are sensitive by nature. This page describes how VoiceLens handles them so that your security and privacy teams can assess the service. For contractual terms see the privacy policy and terms of service; for anything not covered here, write to hello@voicelens.app.
Architecture in one paragraph
VoiceLens runs on Microsoft Azure. The API and the analysis workers are Azure App Service applications; metadata, transcripts and analyses live in Azure SQL; audio is stored in Azure Blob Storage in a container per workspace (vl-audio-{workspaceId}). Transcription is performed by Deepgram over an encrypted connection, and AI summaries and rubric drafts are generated by Anthropic models. The public site and dashboard are served from Azure Static Web Apps.
Isolation
- Every object belongs to exactly one workspace; queries are scoped to the caller's workspace and tenant at the data layer.
- Audio is stored in a per-workspace blob container.
- Credentials (ingest tokens, API keys, embed and share tokens) are each scoped to a single workspace, channel or call, and cannot reach beyond it.
Access control
- Human access follows workspace roles: Viewer, Member, Admin, Owner. Recordings and transcripts are visible only to members of the workspace.
- Dashboard sessions use short-lived access tokens (15 minutes) with refresh tokens revoked on sign-out.
- Email verification is required before a new account can be used.
Credentials for integrations
| Credential | Scope | Capabilities | Controls |
|---|---|---|---|
Ingest token (vk_) | One channel | Create calls only; cannot read anything | Expiry, IP allowlist, revocation, usage tracking |
API key (vlk_) | One workspace | Read-only (Viewer) | Expiry, revocation, 600 requests/min, usage tracking |
Embed token (ve_) | One workspace | Read-only, sanitised dashboard | Allowed origins, expiry, feature flags, revocation, 240 requests/min |
Share token (vs_) | One call | Read one scorecard | Expiry (up to 365 days), revocation, 60 requests/min/IP |
Webhook secret (whsec_) | One endpoint | Signs outbound deliveries | Rotation, shown once |
All plaintext credentials are shown once at creation and stored hashed. Webhook deliveries are signed with HMAC-SHA256 over a timestamp and the raw body so receivers can authenticate them and reject replays; see Webhooks.
Encryption
- All traffic to and from VoiceLens, including to the transcription and AI providers, uses TLS.
- Azure SQL and Azure Blob Storage encrypt data at rest with Microsoft-managed keys.
- Pre-signed upload URLs for the ingest API are write-only and expire after 30 minutes.
- Audio playback is streamed through the API to authorised callers; recordings are never exposed through public storage URLs.
Sub-processors
| Provider | Purpose | Data |
|---|---|---|
| Microsoft Azure | Hosting, database, storage, email delivery | All customer data |
| Deepgram | Speech-to-text, diarization, sentiment | Audio and resulting transcripts |
| Anthropic | Call summaries, AI rubric drafts | Transcript text |
| Stripe | Billing | Billing contact and payment details; never call data |
| Twilio (optional) | Recording download and test calls, using your Twilio account | Recordings you route through Twilio |
Retention and deletion
- Recordings, transcripts and analyses are kept for the life of the workspace, subject to the retention period of your plan as described in the privacy policy.
- An Admin can delete a call at any time; deletion removes the analysis, the transcript, the audio blob, any share links and its golden-set entry.
- Archiving a workspace stops all ingestion. Deleting an account or a workspace's data in full is handled on request through hello@voicelens.app.
- Skipped calls (sampling, minimum duration) store metadata only; their audio is not retained.
Recording consent
You are responsible for obtaining any consent required to record and analyse calls in your jurisdiction. Rubric templates can require a recording disclosure phrase so that calls missing it are flagged as COMPLIANCE_MISS; the attorney-intake and telecom presets do this by default.
Operational
- Ingestion is idempotent and webhooks are retried with backoff, so transient failures do not lose or duplicate data.
- Public surfaces (embeds, shares, API keys) are rate-limited per token or IP.
- The frontend sends
X-Content-Type-Options: nosniffand a strictReferrer-Policy; the dashboard and sign-in pages may only be framed by VoiceLens itself, while embeds may be framed by their configured origins.
Enterprise options
Enterprise plans can include committed volume, an SLA, invoiced billing and private deployment options. Contact sales@voicelens.app to discuss data residency or a security questionnaire.