Security and trust

Client-side encryption by default. End-to-end encrypted messaging. BAA-backed healthcare delivery. Six-year audit retention. Managed cloud, on-premise, and air-gapped deployment paths. Zero protected health information in application logs by design. Every system in the catalog is built on the same security setup as Vavus AI. Ask us if your review needs anything else.

Stored history, documents, and audio are encrypted on the user's device before storage, with a per-user account master key held in the device keychain wrapping per-artifact keys. Messaging uses end-to-end encryption on the Signal Protocol, so the operator of the system cannot read message content. Transport is TLS 1.2 or higher at the load balancer; legacy server-side data at rest is AES-256-GCM, read-only.

Some steps can’t be end-to-end encrypted, but we’ll find the setup that fits your project. Live speech has to be processed briefly in memory to be recognized, translated, and spoken before storage rules apply, and a feature that a server must compute, such as tallying a group poll, cannot be end-to-end encrypted; in healthcare deployments such features are disabled. Where a user explicitly consents to a server-side operation on one item, that consent is recorded and audited.

• Owner, admin, member, and viewer roles with team-level control.
• SAML 2.0 single sign-on with the major identity providers for enterprise accounts.
• Brute-force protection with exponential backoff and account lockout.
• Token revocation on logout and on password change; separate stream tokens for live sessions.
• Breach detection on unusual activity, location changes, and IP anomalies.
• A web application firewall with rate limiting and injection blocking in front of every managed deployment.
• Secure deletion, overwrite before unlink, for any asset that may contain protected health information.

Audit logs record metadata-only events: who did what, when, and from which device. They never contain protected health information, message content, or translation content. They are retained for six years, and for enterprise deployments they can be exported as JSON or streamed to a customer-controlled SIEM.

Healthcare engagements onboard under a signed Business Associate Agreement, and we review each workflow with you before any patient data enters the system. The delivered posture is HIPAA-aligned: 8-hour session token expiry, 15-minute idle timeout, secure deletion of PHI assets, zero PHI in application logs, and six-year audit retention.

Nothing we deliver is a medical device. Output that touches patient care must be reviewed by a qualified clinician, and no system of ours replaces a professional medical interpreter where federal or state law requires one.

Authenticated data export and an account-deletion path are part of every delivered system. We never sell user data and never use customer content to train models. Consent state is tracked per user, cookie consent on the web is granular, and the sub-processors behind a managed deployment are configured to keep content out of model training and never receive a user's account identity. A named sub-processor list is provided under the data processing agreement.

The managed cloud runs across a primary United States region with European and Asian edges behind a global load balancer. Regional data residency is scoped in the quote. Every catalog system can also run on your own cloud or servers, and systems that don’t depend on an outside provider can run fully offline.

Support conversations run on infrastructure we host ourselves, so support transcripts are never handed to a third-party vendor. That matters when a support thread contains a screenshot of patient data.

On request we provide the security documentation pack: encryption architecture diagrams, key management, the audit log schema, deployment topologies, the Business Associate Agreement template, and the data processing agreement template. Request the pack. For security coordination, write to constantine@vavusai.com.