Security and Trust at Revox AI

The short answer

Revox does not operate from a single server location. Our primary application environment and core data services are designed to use U.S.-based cloud infrastructure. However, Revox also relies on specialized providers for telephony, AI, voice, messaging, vector search, payments, and connected systems. Depending on the feature and configuration, those providers or their subprocessors may process information in additional locations.

For that reason, Revox does not represent that every byte of customer information remains in one state, one data center, or exclusively within the United States unless that commitment is expressly stated in a customer-specific written agreement and supported by the applicable technical configuration.

Customers with a contractual data-location requirement should contact Revox before enabling the affected feature. A customer-specific answer requires reviewing every component used by that customer—not only the location of the main web application.

The exact path depends on the feature. A typical voice and insurance-intake workflow may operate as follows:

Depending on the services enabled, Revox may process:

Not every category is collected for every customer or interaction. The availability of a feature does not mean that every kind of sensitive information is appropriate for that feature. Customers should configure workflows to collect only the information needed for their authorized business purpose.

Data in transit

Supported Revox web and API communications use HTTPS/TLS to protect information while it travels between the user, Revox, and participating providers. Third-party portals and customer-connected systems control the security of their own endpoints. Revox cannot guarantee the security of a destination that a customer selects or controls.

Telephone calls and SMS messages also depend on public and carrier telecommunications networks. Revox uses established communications providers, but ordinary telephony and messaging should not be treated as equivalent to a private end-to-end encrypted messaging channel.

Data at rest

Revox relies on the storage encryption supplied by the applicable platform or database provider for supported stored data. For example, Bubble publishes that data in its AWS-hosted environment is encrypted at rest through its database infrastructure, and Pinecone publishes that its vector data is encrypted at rest. AWS encryption capabilities may protect applicable Revox-controlled components, but not every Revox provider or third-party portal runs inside Revox’s AWS environment.

Revox does not claim that all data is protected by one encryption product, one key-management system, or customer-managed keys. Encryption implementation depends on the system in which the information is stored.

Customer access

Users access Revox through authenticated accounts and the permissions available for their organization. Customers are responsible for:

Revox administrative access

Authorized Revox personnel may access customer information when reasonably necessary to configure an account, provide support, investigate a reported issue, monitor service operation, address abuse or security risks, restore functionality, or comply with law. Access is intended to be limited to personnel with a legitimate operational need and subject to confidentiality obligations.

Support access may expose information contained in a transcript, task log, integration response, or screenshot. Revox personnel are expected to use that access only for the applicable support, operational, security, or legal purpose.

Service-to-service access

Revox components communicate with providers and connected systems through supported APIs, webhooks, tokens, service credentials, and authenticated sessions. Credentials and tokens are treated as sensitive operational information. Access should be scoped to the permissions required by the integration where the third-party system supports that level of control.

Revox is a multi-customer service. Application privacy rules and account-level identifiers are used to restrict records to the appropriate customer environment. Workflows, integrations, recipients, and agent configurations are associated with the relevant customer account so that one customer’s configuration is not intentionally used to perform work for another customer.

No application architecture eliminates all risk. Revox reviews and maintains its access logic as the product evolves, and customers should report any unexpected visibility or access behavior immediately.

Revox voice agents may receive or place calls, generate synthetic speech, transcribe conversations, create summaries, collect structured data, route calls, transfer calls, schedule appointments, and send follow-up messages. Depending on configuration, audio and conversation history may be retained by Revox or its voice and communications providers.

Customers control their business purpose, scripts, workflows, recipients, and use of recording. Customers are responsible for providing any notices and obtaining any permissions required for:

Revox supports privacy-conscious configuration. ElevenLabs provides settings for conversation retention, audio saving, redaction, and—on qualifying enterprise arrangements—zero-retention modes. A provider capability applies to Revox only when Revox has actually enabled and configured it for the relevant workspace or customer use case.

Revox uses AI to understand requests, carry on conversations, extract information, classify intent, generate responses and summaries, retrieve relevant knowledge, and assist with configured workflows.

Revox does not sell Customer Data. Revox does not use Customer Data to train a broadly available generalized Revox model unless the customer expressly agrees in writing to that use. Revox may use operational information to provide, secure, support, and improve the service in accordance with its agreements and Privacy Policy, including testing and evaluating product performance with appropriate safeguards.

OpenAI states that information submitted through its API is not used to train or improve OpenAI models unless the API customer affirmatively opts in. OpenAI’s default abuse-monitoring and application-state retention can vary by endpoint and configuration. Zero Data Retention and regional controls are separate, eligibility-based settings and should not be assumed to apply unless confirmed for the Revox project in use.

Other AI and voice providers operate under their own enterprise or API terms, account settings, and retention options. Revox evaluates those terms and configurations for the applicable use, but does not represent that every provider offers identical training, retention, or geographic controls.

AI-generated and extracted information may be incorrect, incomplete, or outdated. Revox customers must review material insurance information and decisions rather than treating an AI response or automation status as an independent guarantee.

Customers may provide files, URLs, text, instructions, scripts, and other sources to help an agent answer questions or complete a workflow. Revox may divide those sources into smaller sections, create mathematical representations known as embeddings, attach metadata, and store them in a vector database so relevant information can be retrieved during an interaction.

An embedding is not automatically anonymous. It may still be connected to customer content, metadata, or an identifiable person. Revox therefore treats embeddings and related metadata as Customer Data where they can be linked to the customer or an individual.

Customers should not place secrets, portal passwords, payment-card data, or unnecessary sensitive personal information in an agent knowledge base. Knowledge sources should be reviewed for accuracy, authorization, and appropriate audience before they are activated.

Revox can exchange information with customer-selected systems through APIs, webhooks, email, SMS, file transfer, or other supported methods. Connected systems may include agency management systems, CRMs, communications services, calendars, carriers, raters, and other insurance technology platforms.

Before information is sent, customers should verify the destination, recipient, integration account, and enabled workflow. Once information reaches a carrier or another independent recipient for its own business purpose, that recipient controls its own copy under its agreements, privacy notice, retention rules, and legal obligations. Disconnecting Revox does not recall information already transmitted or delete records independently retained by the receiving system.

Revox and its providers maintain operational records needed to run and protect the service. Depending on the feature, those records may include login events, call and message status, workflow state, integration requests, delivery status, API responses, portal errors, task actions, timestamps, diagnostic information, and security-relevant events.

These records help Revox:

Logs can contain Customer Data. Access and retention therefore depend on the purpose of the record, the service configuration, the provider involved, and applicable contractual or legal requirements.

Revox uses version-controlled development and deployment processes for its custom services. GitHub supports source-code management, collaboration, review history, and deployment workflows. Production hosting is separated from the source-code repository, and GitHub is not intended to be used as the primary storage location for call transcripts, applicant records, policy information, or portal credentials.

Revox tests changes before production use based on the scope and risk of the change. Updates may include new functionality, integrations, security improvements, dependency updates, bug fixes, workflow revisions, and provider-required changes. Urgent fixes may use an accelerated process when needed to reduce active risk or restore service.

Because Revox also relies on third-party platforms and portals, some changes originate outside Revox’s control. Revox monitors and responds to material provider changes that affect supported workflows, but cannot guarantee that a third-party API, website, carrier portal, telecommunications network, or AI model will remain unchanged or continuously available.

Revox evaluates reported security concerns based on their potential effect on confidentiality, integrity, availability, customers, and individuals. Remediation priority may consider exploitability, affected data, affected customers, availability of compensating controls, and dependencies on third-party providers.

Security researchers and customers can report a suspected vulnerability to security@revoxai.io. Reports should include the affected page or service, a description of the issue, reproducible steps, and any relevant evidence. Do not access, download, alter, or disclose another person’s information while testing, and do not disrupt the service.

Revox does not authorize destructive testing, denial-of-service activity, social engineering, credential attacks, physical attacks, spam, or testing of third-party services that Revox does not control.

Revox maintains an operational process for evaluating suspected security incidents. Depending on the circumstances, response activities may include:

No internet-connected system can be guaranteed completely secure. Revox’s commitments are to maintain reasonable administrative, technical, and organizational safeguards appropriate to the service, respond to credible concerns, and meet applicable notification obligations—not to promise that unauthorized access can never occur.

Revox is built on cloud providers that supply redundant and scalable infrastructure for their respective services. Revox uses provider capabilities, operational monitoring, deployment controls, and recoverability features appropriate to the relevant component.

Availability can still be affected by telecommunications carriers, internet routing, cloud incidents, AI-provider incidents, connected-system outages, expiring portal sessions, changed third-party websites, rate limits, customer configuration, maintenance, and events outside Revox’s reasonable control. Unless a separate service-level agreement says otherwise, Revox does not promise uninterrupted or error-free operation or a specific recovery time.

Revox retains information according to the type of record, the enabled feature, customer configuration, operational need, contractual obligations, legal requirements, dispute or security needs, and the retention behavior of the provider involved.

Examples include:

When a customer requests deletion or closes an account, Revox evaluates and removes information from the systems it controls in accordance with the applicable agreement, product capabilities, and legal obligations. Deletion from an active system may not immediately remove the same information from encrypted backups, security records, or a provider’s legally required records.

Deletion by Revox also cannot erase information already delivered to an agency, carrier, rater, CRM, email recipient, telecommunications provider, payment processor, or other independent recipient. Customers may need to submit a separate request to those parties.

Customers with a required retention schedule should arrange it with Revox in writing so the applicable product settings, provider capabilities, and legal requirements can be reviewed before use.

Revox uses Stripe to process subscription payments. Payment-card information entered into Stripe-hosted or Stripe-supported payment fields is handled by Stripe under its payment-security program. Revox generally receives limited billing information, transaction identifiers, payment status, card brand, and limited card details needed to administer the subscription rather than the complete card number or security code.

Customers should never place payment-card numbers or card security codes in Revox agent prompts, knowledge bases, ordinary support messages, or intake fields unless Revox has expressly approved a dedicated workflow designed for that information.

Security and privacy are related but distinct. Revox may act as a processor or service provider for information handled on behalf of a customer and as a controller or business for its own account, billing, website, support, and security information. The applicable role depends on the activity and law.

Insurance agencies remain responsible for their own legal basis, notices, authorizations, data accuracy, licensing obligations, carrier permissions, communications consent, recordkeeping, and employee access. Revox remains responsible for the obligations that apply to Revox and for following applicable documented customer instructions.

Revox should not be used to process protected health information or another specially regulated data category that requires a specific written agreement or certified environment unless Revox has expressly approved that use in writing and all required agreements and configurations are in place.

Revox uses providers for specific operational purposes. The provider used can change as the platform evolves, and a provider may use its own subprocessors.

Use of a provider does not mean every Revox customer uses every provider. It also does not mean that all information described above is sent in every request.

Several Revox infrastructure providers publish independent security and compliance programs, which may include SOC 2, ISO 27001, PCI DSS, GDPR-oriented contractual measures, or other frameworks applicable to their own services.

Those reports and certifications apply to the provider and the scope described in the provider’s documentation. They do not automatically certify Revox AI LLC, the Revox application, a customer’s implementation, or every end-to-end workflow.

Unless Revox expressly states otherwise in a current written document, Revox does not claim that it is independently certified under SOC 2 or ISO 27001, that every service is HIPAA compliant, that every workflow is PCI compliant, or that use of Revox by itself makes a customer compliant with any law or framework.

Revox can respond to reasonable customer security questions and discuss contractual or technical requirements appropriate to the proposed use case.

Security works only when Revox and the customer each protect the parts they control.

Revox AI LLC

Delaware, United States

Last updated: September 11, 2026