What Vocivo does with your data, stated plainly.

Where data lives

A hosted workspace lives in one Vocivo stack in the provider region you chose. Its people, call records, recordings, transcripts, voicemail, messages and meetings are stored there. Vocivo’s central service keeps only routing facts: which region a workspace lives in, and a keyed hash of each user’s email address so sign-in can find it. A self-hosted server keeps everything on your server; only licence check-ins and phone wake-ups reach Vocivo. See Hosting.

Carrier passwords and secrets

Carrier passwords for registration trunks are encrypted at rest with AES-256-GCM, which also detects tampering. They are never shown again after you save them. IP-authenticated trunks need no password at all. Server secrets live in the server’s own environment and never in the website or the web app.

Sign-in and sessions

Sessions use an HTTP-only cookie with a separate token that state-changing requests must echo, which protects against cross-site request forgery. A session slides forward while it is used and expires when idle, with an absolute limit. Phones have their own, longer idle window so people stay signed in on a phone they use every day. Sign-in attempts are rate-limited per account.

The operator console runs on its own host name with its own sign-in. A session in a customer workspace never carries into it.

Calling controls

Administrators set who may call internationally, which countries are allowed, which prefixes are blocked, how many calls may run at once, and whether calls are blocked out of hours. A single switch suspends all outgoing calls. The AI receptionist can only transfer callers to extensions on its list, never to a number a caller reads out.

Recording and AI consent

Recording starts on demand. Many places require you to tell callers a call is recorded, and some require everyone’s consent. When the AI receptionist answers with GPT-Live, the caller’s voice audio is processed by OpenAI. Your greetings are yours to write; use them to tell callers both things in words that meet your local rules.

Emergency calling

Emergency numbers are never blocked by calling policy, suspensions, plan limits or the wallet. Calls carry a callback number and each person’s registered site address, and your designated contacts are alerted when one is placed (Kari’s Law, RAY BAUM’S Act).

Your responsibilities: keep each site’s address current, register addresses with your carrier where it requires them, tell people using Vocivo away from the office about its limits, and test emergency routing with your carrier before you rely on it. Whether and how an emergency call reaches the local emergency service is decided by your carrier and your local rules.