Trust & Security
Brainova AI encrypts all data with AES-256 at rest and TLS 1.3 in transit, enforces role-based access controls, maintains immutable audit logs, and conducts annual penetration testing. Our infrastructure maintains a 99.9% uptime SLA.
End-to-End Encryption
All data encrypted at rest with AES-256 and in transit with TLS 1.3. Encryption keys managed via dedicated key management with automatic rotation. No unencrypted data touches our servers.
Access Controls & Audit Logging
Role-based access control (RBAC) on all accounts. Immutable audit logs track every data access with user identity, timestamp, and action. Logs retained for a minimum of 3 years.
Annual Penetration Testing
Independent third-party penetration testing every year. Continuous vulnerability scanning across all production systems. Critical findings remediated within 24 hours.
99.9% Uptime SLA
Enterprise-grade infrastructure with multi-region redundancy. Real-time status at status.brainova.ai. Service credits issued for any downtime.
Data Security & Encryption
Businesses trust us with sensitive call data and customer information. We protect it with multiple layers of security — not compliance checkboxes, but concrete technical controls.
Encryption Standards
AES-256 encryption for all data at rest. TLS 1.3 enforced for all data in transit. SRTP for voice media streams. Encryption keys managed via dedicated key management service with automatic annual rotation.
Access Controls
Role-based access control (RBAC) on every account. Enterprise plans support SSO via SAML 2.0 and OIDC. All employee access to customer data requires role justification and manager approval.
Audit Logging
Every data access is logged with user identity, timestamp, and action performed. Logs are immutable and retained for a minimum of 3 years. Audit reports available to Enterprise customers upon request.
Security Testing
Annual third-party penetration testing by independent security firms. Continuous vulnerability scanning across all production systems. Critical findings remediated within 24 hours.
Encryption & Infrastructure
We apply defense-in-depth security across every layer of our stack. No shortcuts.
Data at Rest
AES-256 encryption for all stored data, including call recordings, transcripts, and customer records. Encryption keys managed via AWS KMS with automatic annual rotation.
Data in Transit
TLS 1.3 enforced on all connections. SRTP for voice media streams. HSTS headers with a minimum 1-year max-age. No fallback to unencrypted protocols.
Network Security
VPC isolation for all production workloads. Web application firewall (WAF) and DDoS protection on all public endpoints. Network segmentation between customer tenants.
Infrastructure
Multi-region deployment with automatic failover. All infrastructure is provisioned as code and deployed through audited CI/CD pipelines. No manual server access in production.
Data Handling Practices
Transparency is foundational to trust. Here is how we collect, process, store, and delete your data.
Data Residency
All customer data is stored in secure, audited data centers within the United States. Enterprise customers can request specific region deployment.
Data Retention
Call recordings and transcripts are retained for 90 days by default. Customers can configure custom retention policies from 30 days to 1 year. Data is permanently deleted upon account cancellation within 30 days.
Access Controls
Role-based access control (RBAC) on all accounts. Enterprise plans support SSO via SAML 2.0 and OIDC. All employee access to customer data is logged and reviewed quarterly.
Third-Party Processing
We use a limited set of vetted subprocessors for infrastructure and AI model hosting. All subprocessors are contractually bound to the same data protection standards. A current list is available upon request.
Incident Response
Dedicated security response team with a documented incident response plan. Customers are notified within 72 hours of any confirmed data breach. Post-incident reports provided to affected accounts.
Penetration Testing
Annual third-party penetration testing by independent security firms. Continuous vulnerability scanning across all production systems. Critical findings remediated within 24 hours.
Uptime & Reliability
When your AI voice agent goes down, your phone stops getting answered. We engineer our platform so that does not happen.
99.9%
Enterprise uptime SLA
< 200ms
Median API response time
3 regions
Redundant data centers
Multi-region active-active deployment with automatic failover under 30 seconds
Real-time status page at status.brainova.ai with historical uptime data
Automatic service credits if uptime falls below SLA commitment
Planned maintenance windows communicated 72 hours in advance via email and status page
Policies & Agreements
Our commitment to transparency extends across every document governing your relationship with Brainova AI.
Privacy Policy
How we collect, use, and protect your data
Terms of Service
Service terms, billing, and acceptable use
Data Processing Agreement
For Professional and Enterprise customers
Have Security Questions?
Our security team is available to discuss your security requirements or review our data protection practices.
Frequently Asked Questions
About the Service
Brainova AI uses enterprise-grade security across every layer of our platform. All data is encrypted with AES-256 at rest and TLS 1.3 in transit. We enforce role-based access controls, maintain immutable audit logs, and conduct annual penetration testing by independent security firms. Your data is never shared between customer accounts.
Access to customer data is strictly controlled through role-based access control (RBAC). All employee access to customer environments requires role justification and manager approval. Every access event is logged with user identity, timestamp, and action performed. Enterprise plans support SSO via SAML 2.0 and OIDC for additional access management.
Yes. We provide data protection agreements to customers on Professional and Enterprise plans. These agreements outline our data handling obligations, security practices, and breach notification commitments. See our Data Processing Agreement page for details, or contact our team to request one.
Call recordings are encrypted at rest with AES-256 encryption and in transit with TLS 1.3. Access to recordings requires authenticated API calls or dashboard login with appropriate RBAC permissions. Recordings are automatically deleted based on your configured retention policy.
Getting Started
We conduct annual penetration testing through independent third-party security firms. We also run continuous vulnerability scanning across all production systems and remediate critical findings within 24 hours. Security audit summaries are available to Enterprise customers upon request.
All customer data is stored in secure, audited data centers within the United States. We use redundant storage with automatic failover across multiple availability zones. Enterprise customers can request specific region deployments for data residency requirements.
Upon account cancellation, you can export all your data within a 30-day grace period. After 30 days, all data including call recordings, transcripts, and account information is permanently and irreversibly deleted from our systems and backups.
Our AI voice models run in isolated, sandboxed environments. Customer data is never used to train or improve our models without explicit opt-in consent. Model inputs and outputs are encrypted and logged for audit purposes. We do not share data between customer accounts.
Last updated: