Security
Security and data handling at Sonex Labs.
How we protect your account, your call data and your customers' data, what is not in place yet, and how to report a security problem.
Workspaces
Each customer's data stays in its own workspace.
Every agent, call record, recording, API key, setting and phone provider connection you add belongs to one workspace. Before our backend reads or changes a workspace's data, it checks that the signed-in person is a member of that workspace, and it refuses the request if they are not.
The database tables that hold customer data also carry row-level security policies, which limit each row to members of the workspace it belongs to. These policies are a second layer of protection. Our backend connects to the database with a service account that the policies do not restrict, so the membership check in the backend is the main control.
Inside a workspace, people are owners, admins or members. Only owners and admins can invite or remove people.
Call recordings
Recordings are kept in private storage.
Call recordings are stored as audio files in a private storage bucket, filed under your workspace. The bucket has no public address. To play a recording, the dashboard or the API creates a signed link that stops working after a short time: one hour in the dashboard, and 15 minutes for links returned by the Calls API.
Transcripts and call records (duration, status, cost and the campaign a call belonged to) are stored in the database with the rest of your workspace's data.
There is no setting yet that deletes recordings and transcripts automatically after a fixed period. They stay in your account until they are deleted. To have recordings, transcripts or your whole account deleted, email support@sonexlabs.com. Our privacy policy describes how deletion requests work and the legal limits on them.
API keys and credentials
We store a fingerprint of your API key, not the key.
An API key is shown once, when you create it. We store only a SHA-256 hash of it, plus the first few characters so you can tell your keys apart in the dashboard. We cannot show you a key again after it is created; if you lose one, revoke it and create a new one.
A revoked key stops working within 30 seconds. Every key has full access to its workspace: there are no per-key permission scopes yet. Keep keys on your server, and never put them in a web page or a mobile app.
Secrets you save on the platform, such as the account credentials for your own phone provider, secret variables used by tools, and the access tokens of connected tools, are encrypted by our application before they are written to the database. The dashboard shows only their last four characters.
Connections
Your connections to us use HTTPS.
The website, the dashboard, the API at api.sonexlabs.com and the WebSocket endpoints that phone providers stream call audio to are all served over TLS (HTTPS and secure WebSockets). The website tells browsers to use HTTPS only, through a Strict-Transport-Security header.
Your data and our models
Your calls are not used to train our models.
We do not use your call content, scripts, voice recordings or personal data to train, fine-tune or evaluate our AI models unless you have given explicit written consent.
When you use Sonex Labs to call people, you are the data controller for those people's personal data and we process it only on your instructions, as a data processor. Enterprise customers who need a Data Processing Agreement can ask for one at support@sonexlabs.com.
Card payments are handled by our payment provider. Sonex Labs never stores card details.
Service providers
Who else handles data to run the service.
Running voice agents takes several kinds of providers. Each receives only the data it needs for its part of the work:
- Cloud and server hosting: the servers, database, sign-in service and file storage that run the platform, and the GPU servers that run our speech models.
- AI model providers: for some speech recognition and language model work, audio or text is processed by a third-party model provider on our behalf.
- Telephony providers: the carriers that connect calls to the phone network, either on numbers we manage or through your own account with a provider such as Twilio or Exotel.
- Payment processing: wallet top-ups.
- Monitoring and logging: error tracking and performance diagnostics that keep the platform running.
We do not sell personal data, and we do not share it with advertisers or data brokers. If your vendor review needs the named list of providers, ask us.
Monitoring
What we watch, and what we tell you.
We log security events for our own monitoring, including failed sign-ins, API keys being created and revoked, and requests that hit a rate limit. Our internal admin tools are open only to an approved list of Sonex Labs staff accounts. The dashboard does not yet show customers an audit log of these events.
Outages and incidents are posted on our public status page. If a data breach affects your personal data, we will tell you as the law requires.
Report a vulnerability
How to report a security problem.
Email support@sonexlabs.com with "Security report" in the subject line.
Please include:
- What you found and where: the page, API endpoint or feature.
- The steps to reproduce it, and what an attacker could do with it.
- Your name or handle, if you would like to be credited.
While you look into it, we ask that you:
- Use your own account and test data. Do not open, change or delete other customers' data beyond the minimum needed to show the problem.
- Do not place calls to people who have not agreed to them, and do not run tests that slow down or interrupt the service.
- Give us a reasonable time to fix the problem before you make it public.
If you think someone has got into your own Sonex Labs account, email the same address straight away, as our terms of use ask, and revoke any API keys you are unsure about from the dashboard.
FAQ
Common questions about security.
Last reviewed 24 October 2026. See also the privacy policy and the terms of use.
No. We do not use your call content, scripts, voice recordings or personal data to train, fine-tune or evaluate our AI models unless you have given explicit written consent.
Members of your workspace in the dashboard, and anyone using one of your workspace's API keys. Recordings sit in a private storage bucket with no public address, and each playback link is signed and stops working after at most one hour.
Until they are deleted. There is no automatic deletion schedule yet. To have recordings, transcripts or your whole account deleted, email support@sonexlabs.com.
We delete its record, its reference recording in storage and its copy on our speech servers. If any of those steps fails, our team is alerted so the leftover copy can be removed.
Yes. You can connect your own Twilio or Exotel account instead of using numbers we manage. The account secrets you enter are encrypted before they are stored, and the dashboard shows only their last four characters.
Enterprise customers can ask for a Data Processing Agreement at support@sonexlabs.com. Send your questionnaire to the same address. This page describes the controls in place today; if your review needs a specific document, tell us which one.
Ask us how we handle your data.
Email support@sonexlabs.com with your question, your security questionnaire or a vulnerability report.