Your calls are sensitive. We built APX like it.
Recordings hold your customers' voices, account details, and your team's best and worst moments. Here's exactly how we keep them private, who can reach them, and which vendors touch them.
- AES-256
- Encryption for your phone-system credentials
- 1 hour
- Lifetime of any link to a call recording
- Every table
- Isolated to your organization at the database
- Zero
- Models we train on your calls
Our approach
Three rules we don't bend.
Security isn't a feature we bolted on. These are the defaults every part of APX is built around.
Isolated by default
Every record belongs to one organization. The database itself refuses to return another organization's calls, transcripts, or scores, even if application code asks for them.
Least access
Recordings are never public. Nobody, including your own browser, can read the storage bucket directly. Access is granted one call at a time, after an ownership check, for one hour.
Your data, not training data
Your calls are analyzed against the scorecard you write, and that's all they're used for. APX does not train or fine-tune AI models on your recordings or transcripts.
Follow a call
What happens to a call, step by step.
From the moment your phone system hands us a recording to the moment a manager opens the report.
- 01
Your phone system
Twilio, Telnyx and Aircall are polled with API keys you provide. Other systems push to a signed webhook.
Credentials encrypted · HMAC-signed webhooks - 02
Private storage
The recording is copied into a private bucket under your organization's folder.
Service-role only · no public URLs - 03
Transcription
AssemblyAI receives a short-lived signed link to the audio and returns a transcript.
Link expires in 1 hour - 04
Analysis
Your agent's prompt and the transcript go to the language model. The score and report come back.
Prompt-injection boundaries - 05
Your dashboard
Only signed-in members of your organization can see the call, the report, and the audio.
Row-level security on every read
Protections
The details, for your security review.
Tenant isolation
- Postgres row-level security on every table that holds customer data
- Policies scope each query to the organizations you belong to
- Deleted records are hidden by the same policies
Encryption
- TLS for all traffic between your browser, APX, and our vendors
- Database and file storage encrypted at rest by our infrastructure provider
- Phone-system API keys additionally encrypted by APX with AES-256-GCM
Recording access
- Recordings live in a private bucket that browsers cannot read
- Each playback link is minted after checking you own the call
- Links expire after one hour
Integrations & webhooks
- Custom webhooks must be signed with HMAC-SHA256 or they're rejected
- Webhook secrets are shown once and stored only as a hash
- Raw webhook payloads are purged after 30 days
AI safeguards
- Transcripts are fenced off from instructions so a caller can't redirect the analysis
- Model output is validated against a strict schema before it's saved
- Low-confidence or refused analyses are flagged, not silently scored
Operations
- The web app never queries the database directly; requests go through server functions that check your session
- Service keys are kept in encrypted secrets storage, not in code
- Errors are logged centrally so failures surface instead of disappearing
Data handling
What we keep, and for how long.
You own your data. Email us and we'll permanently delete your recordings, transcripts, and analyses.
| Data | Why we have it | Retention |
|---|---|---|
| Call recordings | Playback and transcription | While your account is active, or until you ask us to delete them |
| Transcripts & analyses | Reports, scores, trends, and alerts | While your account is active, or until you ask us to delete them |
| Call metadata | Phone numbers, direction, duration, and timestamps for your call list | While your account is active, or until you ask us to delete them |
| Phone-system credentials | Fetching new recordings from Twilio, Telnyx or Aircall | Until you disconnect the integration |
| Raw webhook payloads | Debugging and replaying failed deliveries | 30 days, then deleted automatically |
Subprocessors
Who else touches your data.
The vendors that process customer data on our behalf. We'll update this list before adding a new one.
- SupabaseDatabase, file storage, authentication, and server functions
- VercelHosting for the APX web app and website
- AssemblyAISpeech-to-text transcription of call recordings
- GroqLanguage-model inference for call analysis
- ResendTransactional email: alerts, digests, and account email
Shared responsibility
Where your part begins.
APX secures the platform. A few things only you can control.
Recording consent
Call-recording laws vary by state and country, and some require every party's consent. You're responsible for notifying callers and getting consent where required.
Dedicated API keys
When you connect Twilio, Telnyx or Aircall, create a separate API key just for APX, with the narrowest permissions your provider allows. Revoke it at the provider any time and APX stops pulling calls.
Who's in your organization
Everyone you add to your organization can see its calls. Remove people when they leave, and keep admin access to the few who need it.
Security questionnaire or DPA?
Send it over. You'll get answers from the person who built the platform, not a sales team.
Email security@apxintelligence.comFound a vulnerability?
Please report it privately with steps to reproduce. We'll confirm receipt within two business days and keep you posted on the fix. Please don't access other customers' data or disrupt the service while testing.
Report a vulnerability