Security

Vocifer keeps payroll, tax forms, bank lines, and your team's details, so it's built to protect them. This page says how, plainly. For what we collect and why, see the Privacy Policy.

Locked, space by space

• Each space has its own key. Every business, rental, and Personal space has its own encryption key. Everything in it is encrypted with that key: documents, chats, call transcripts, the books, and the team.
• Only our servers hold the keys. Each space's key is locked by Vocifer's master key, which is kept apart from your data and held in our servers' memory while they run. Vocifer uses it to do your work: the assistant, your phone line, reminders, payroll prep. A copy of our data without that master key reads nothing.
• No staff browsing. No one at Vocifer browses your data. There's no admin screen that shows what's in your account, and there won't be. We see only what you send us yourself, like a problem report, or your carrier details when you move a phone number to us (erased once the move is done).
• Deleting means gone. When a space is deleted, its key is destroyed before anything else, then its files and its backups are erased, so nothing of it can be read again. You get a receipt with the time its key was destroyed.
• Backups are your choice. Off, we keep no copies. On, we keep an encrypted copy each day for 30 days, so we can bring your data back if something breaks. Turn them off and every copy is deleted at once. Find it in Profile, under Your data. (While we update our servers we keep a short safety copy, deleted within 7 days.)

Signing in

• Sign in with your email or user ID. On the website you can also continue with Google. An account made with Google has no password, so there's none to guess.
• Passwords are stored only as one-way hashes (scrypt), never as text.
• Sessions use random tokens. We store only a hash of each token, and a session ends after 12 hours.
• Each sign-in opens only your spaces. A request for anyone else's space is refused.
• Repeated guessing is slowed down. Sign-in, account restore, and link attempts are limited per internet address.
• Face ID happens on your phone, and your face never leaves it. You can remove a phone from your Profile at any time.
• Time-clock PINs are stored only as hashes. Five wrong tries lock that person out of the clock for 15 minutes.

Sensitive paperwork

• New hires' details stay in the signed forms. The Social Security number, date of birth, address, and bank account are stored only inside the signed forms, which are locked. They aren't copied into the team list, and they aren't emailed.
• The lockbox: only you can open it. Set it up once, on Team. From then on, your team's signed W-4s, W-9s, I-9s, and direct-deposit forms are locked so that only your own phone or computer can open them. Vocifer can't, even if our servers were broken into. Opening it on a new device takes your recovery code, plus a code to your email and one to your phone. If you lose every device and the recovery code, nobody can open it, so keep the code in your password manager.
• Every signature is recorded. E-signatures record the signer, the time, the device, and the internet address, along with a fingerprint of the pages as signed.
• Changes to pay, letting someone go, and approving payroll never happen from a chat message alone. They wait for the owner's tap.

AI

• Nothing kept. Typed messages go to AI models run by US providers that keep nothing once they've answered (zero data retention).
• Google, under paid terms. Photos, documents, recordings, and web searches go to Google's Gemini under its paid-API terms, which don't use them to improve Google's products.
• No training. Your information is never used to train AI models.
• Content is data, not commands. Emails, documents, and web pages the AI reads are treated as information, never as instructions.

Connections

• Email and calendar. When you connect Gmail or Outlook, Vocifer asks to read your mail and calendar and to send email from your address. It sends only what you approve, like an order to a vendor. For each email it keeps the sender, the subject, a short snippet, and a summary, never the body.
• App passwords. If you let Vocifer send from your mailbox with an app password instead, it's stored encrypted and never shown again.
• Connection tokens are encrypted (for email, payroll, and bank), and disconnecting deletes them.
• We never see your bank login. Bank connections go through Plaid.
• We never see card numbers. Payments go through Stripe.

In transit and in our hands

• Everything travels encrypted. All traffic between the apps and Vocifer uses HTTPS.
• Our admin panel shows accounts, plans, and usage counts, not what you've typed or uploaded.
• A problem report holds only what you send with it: your words and the last 10 messages of that chat. The form tells you before you send.

Your control

• Download everything, any time: records as spreadsheets and documents, plus a restore file.
• Delete your account in the app (Profile → Cancel or delete account). Keys are destroyed first, then files are erased.

Reporting a security issue

Found a problem? Email privacy@vocifer.com. Please give us time to fix it before you share it.