Encrypted everywhere
Every conversation, transcript, and insight is encrypted in transit with TLS 1.2+ and at rest with AES-256. Research assets live in private, access-controlled storage and are served only through short-lived signed URLs.
Leave us a message
Security
Security built for institutions that can't compromise.
CrowdVox is trusted with candid human conversations. We protect that trust with enterprise-grade security at every layer, from the interview to the insight, and we can show your security team exactly how.
Access under control
Single sign-on, multi-factor authentication with device binding, and role-based permissions scoped to your organization ensure only the right people see your research, and nothing more.
Verifiable by design
Every request, model invocation, and computation is logged with a traceable ID, and every published quote is machine-verified against its source transcript. We don't ask for trust; we produce evidence.
Defense in depth
Security isn't a feature we added; it's how the platform is built. Every layer of CrowdVox assumes the layer above it could fail.
Infrastructure security
- Hosted on enterprise-grade cloud infrastructure with hardened, access-controlled compute
- Analysis runs in an isolated environment, fully separated from the application tier
- Service tiers communicate over private, access-controlled channels with strict network policies
Data encryption
- TLS 1.2+ for all data in transit
- AES-256 encryption at rest across storage and databases
- Private storage containers; assets exposed only via expiring, cryptographically signed URLs
Identity & access
- SSO via OIDC with major enterprise identity providers
- Multi-factor authentication with one-time passcodes and device binding
- Server-side session management with instant revocation and concurrent-session limits
- Credentials protected with salted, adaptive one-way hashing; authentication endpoints are rate-limited and brute-force resistant
Application security
- Fine-grained, role-based access control down to individual platform modules
- Hard tenant isolation: every query is scoped to your organization at the data layer
- Hardened security headers and strict origin allow-lists across the API surface
- Purpose-scoped, expiring tokens for every sensitive flow
- Third-party dependencies monitored and patched on a regular cadence
Model isolation & safety
- Every analysis runs inside an isolated project workspace with no cross-project access
- All computation executes in a locked-down environment with no external network access and strict resource limits
- Models run under enterprise agreements; your data is never used to train models
- Layered guardrails constrain every output to your project's own data
Auditability
- Structured request logs with unique trace IDs across every service
- Every model invocation captured in dedicated, timestamped audit logs
- Every computation writes an inspectable run record
- Published quotes are automatically verified verbatim against source transcripts
Operational security
Technology is only half of security. Our operating practices cover the people, processes, and failure scenarios behind it.
Incident response
A defined incident response process covers detection, containment, remediation, and recovery. Customers are notified of confirmed incidents affecting their data without undue delay, followed by a post-incident summary of root cause and corrective action.
People & internal access
Internal access to customer data is least-privilege and need-to-know. All personnel operate under confidentiality obligations, and access is reviewed regularly and revoked immediately on role change or departure.
Resilience & continuity
Customer data is protected by automated, encrypted backups with defined retention. Recovery procedures are documented and exercised as part of our business continuity planning.
Customer data is hosted in enterprise cloud regions. Regional data residency options are available for enterprise engagements.
Compliance & standards
Our controls are built around recognized frameworks, so your security and legal teams can evaluate CrowdVox with confidence.
GDPR & CCPA
Data processing practices designed around GDPR and CCPA obligations. Data processing agreements, including subprocessor disclosures, are available to every customer.
SOC 2 aligned
Controls mapped to the SOC 2 Trust Services Criteria across security, availability, and confidentiality. Formal certification is on our active roadmap; our current control mapping is available under NDA.
Responsible disclosure
We welcome reports from security researchers and commit to timely triage, remediation, and acknowledgment of verified findings. Contact security@crowdvox.ai.
Your data belongs to you. CrowdVox never sells customer or participant data, and your research is never used to train models for other customers. See our Privacy Controls for how we protect the people behind the conversations.
Raising the bar, continuously
Security is a program, not a page. Here is what we are actively investing in next, stated plainly, because your diligence deserves candor.
Independent penetration testing
On a recurring cadence, with summaries available to customers under NDA.
SOC 2 Type II certification
Building on our existing control mapping.
Centralized secrets management
With automated credential rotation.
Automated PII detection
Layered on top of our existing identity-minimizing design.
Automated dependency and vulnerability scanning
Integrated into the delivery pipeline.
Have questions for your security review?
We're happy to walk your security, legal, and procurement teams through our architecture, controls, and documentation. We support security questionnaires and RFP responses as part of enterprise procurement.