Security and privacy

How Nevox protects the data that goes through the API, and your responsibilities in the integration.

What Nevox does

Encryption: all traffic uses HTTPS (TLS 1.2 or higher). Data is encrypted in the database.
Isolation: each account sees only its own data. A key never accesses another account's data.
Keys and secrets: we store only the hash of API keys. Webhook and action secrets are shown only once.
Training data: what goes through Nevox (conversations, knowledge, events) is not used to train third-party AI models.
Portability: you can export your data at any time and take everything with you if you leave.
Deletion: DELETE /v1/contacts/{external_id} immediately deletes the contact and their conversations and messages.
Access log: every API call is logged with the key used, the time, and the result for 30 days, visible in Dashboard → Developers.
Agent rules: the agent doesn't make up information, doesn't ask for card numbers, passwords, or ID documents, and doesn't give medical, legal, or financial advice, on any channel.

US laws and LGPD

Nevox acts as a service provider (CCPA and US state privacy laws) or processor ("operadora", under Brazil's LGPD) of your customers' data. You remain the controller: you decide what is collected and why.

The data processing terms are at /en/terms and the privacy policy at /en/privacy.
State in your privacy policy that you use Nevox for customer service and analytics.
Use tracking consent connected to your cookie banner.

Health data

If your business is in healthcare in the US and will handle protected health information (PHI, under HIPAA), talk to us first before sending that kind of data through the API. In the meantime:

don't send diagnoses, test results, prescriptions, or medical history in contacts, events, metadata, or knowledge;
in actions, return only what's needed for the conversation (e.g. date, time, and the doctor's name, but never the reason for the visit).

Your responsibilities

Secret keys on the server only. Never in the frontend, in mobile apps, or in repositories.
Minimum scopes. Each system gets its own key with only the scopes it uses.
Always verify signatures on webhooks and actions.
Allowed domains configured for the publishable key.
Authorize in your own system. In actions, check that the contact is allowed to do that. The agent should never be the only safeguard.
Minimum data. Send Nevox only what the agent needs to help the customer.

Report a vulnerability

Found a security issue? Email security@nevox.ai. We respond within 2 business days.