Security & compliance
If you're filling out a security questionnaire or checking a box for procurement: Voze runs a Drata-managed SOC 2 program with our observation window underway, an annual third-party penetration test, and the same controls your other enterprise vendors run. The longer answer is right here — and if your IT team needs a conversation with ours, we'll set it up.
If you're filling out an internal security review or vendor questionnaire on Voze, this is the short version. Each item maps to a question your team has almost certainly asked of another SaaS vendor before.
If you've signed off on HubSpot, Salesforce, or any modern SaaS app in the last few years, the controls below will look familiar. The deep technical detail lives in our security questionnaire responses and Drata trust profile; this is the short version.
TLS 1.2+ in transit. AES-256 at rest. Voice notes, transcripts, account records, and signals are all encrypted across our infrastructure — and the keys are managed inside AWS and Azure, not in our application.
SSO and MFA through your identity provider. Role-based access at the account, territory, and rep level. Voze respects who owns what in your CRM and inherits the same boundaries.
Production systems run in US-based AWS and Microsoft Azure regions. Backups are stored separately and tested regularly. Disaster recovery is part of our SOC 2 program scope.
Admin and user activity is logged with timestamps and user attribution. Customer admins can review their own access history; full audit trails are available to your security team during the sales process.
Subprocessors go through annual security review and sign data-processing agreements through Drata. The current subprocessor list is part of the security packet we share during your evaluation.
Voze employees and contractors complete security training and acknowledge our policies annually through Drata. Background checks for production-access roles. Offboarding revokes access within 24 hours.
Some questions don't fit on a marketing page — and shouldn't. If your security review needs the full report, a deeper architecture conversation, or specific control evidence, we'll route you to the Voze IT team during the sales process.
Security questionnaire responses, Drata trust profile, pen test executive summary, current subprocessor list, and DPA. Shared under NDA during your evaluation. SOC 2 Type 1 report joins the packet once our audit completes.
If your security lead wants a working session with our team to review controls, architecture, or specific questionnaire items — we'll schedule a 45-minute call. Most evaluations don't need this. The ones that do appreciate it.
Our standard responses cover about 80% of typical security questionnaires (SIG, CAIQ, custom). We complete the remaining 20% with your team in the same call. Most reviews close in under two weeks.
Start an evaluation and we'll share our security packet — Drata trust profile, questionnaire responses, pen test summary, and DPA — under NDA. If your IT team wants a working session with ours, we'll set that up too.