Security at Neyvo
Businesses trust Neyvo with conversations with their customers. We protect that data with layered security across our infrastructure, our application, and our team.
Last updated: October 18, 2026
Encryption
All traffic uses TLS 1.2 or higher, including dashboard, API, webhook, and real-time media connections. Databases, recordings, and backups are encrypted at rest with AES-256.
Tenant isolation
Every API request is checked against the authenticated workspace. Database row-level security keeps one customer from ever reading another customer’s calls, messages, or contacts.
Access control
Production access is limited to a small number of engineers, protected by SSO and multi-factor authentication, and logged. Secrets are kept in managed secret stores, never in source code.
Monitoring
Error tracking, structured logs, and live health checks watch every call and message pipeline around the clock, with automated alerts for anomalies.
Resilient infrastructure
Neyvo runs on Amazon Web Services and Fly.io with containerized services, automated deployments, staging-before-production releases, and documented rollback procedures.
Payment security
Card payments are processed by Stripe, a PCI DSS Level 1 provider. Neyvo never stores full card numbers.
Data handling
- Data minimization: operators collect only the fields a workflow needs. Customers control what is recorded and stored.
- Recording retention: recording links expire after 30 days by default, and customers can configure a shorter or longer period.
- Model training: customer call audio, transcripts, and messages are not used to train general-purpose AI models.
- Sub-processors: every vendor that handles customer data is listed in our Privacy Policy.
- Deletion: workspace data is deleted or anonymized within 90 days of account closure.
Messaging safety
- Opt-outs (STOP replies, unsubscribe links, verbal do-not-call requests) are honored automatically across channels.
- Email bounces and spam complaints feed a permanent suppression list that is checked before every send.
- Rate limits, concurrency caps, and scheduling windows prevent abusive calling and messaging.
- Sending domains are authenticated with SPF, DKIM, and DMARC. See our Acceptable Use & Messaging Policy.
Compliance status
| Framework | Status |
|---|---|
| FERPA | Compliant |
| SOC 2 | In Progress |
| HIPAA | In Progress |
| ISO 27001 | In Progress |
HIPAA support, including a Business Associate Agreement, is available to healthcare customers on eligible plans. Contact us to review your requirements.
People and process
- Code changes are peer reviewed and tested in a staging environment before release to production.
- Team members follow least-privilege access, and access is removed immediately when someone leaves.
- We keep an incident response process with defined severity levels, and we notify affected customers without undue delay if a breach affects their data.
Responsible disclosure
If you believe you have found a security vulnerability, please email hi@neyvo.ai with the subject “Security report”. Include steps to reproduce the issue. Please give us a reasonable amount of time to fix it before you disclose it publicly, and do not access other customers' data. We acknowledge reports within two business days and will not take legal action against good-faith research.