Security
Last updated: July 22, 2026
VERACO LLC (“CoServe”) builds an AI receptionist for small service businesses. This page summarizes the technical and organizational controls that protect customer and caller data. It is not a certification — see the honest status notes below.
1. What we protect
The Service processes business account data and, during phone calls, live audio that is transcribed for summaries, CRM updates, and training review. We do not write Twilio call recordings to disk — audio is streamed for the live conversation; what we retain is the transcript and AI-generated summary under the owning company’s tenant.
2. Controls in production today
- Encryption in transit. All customer-facing apps and APIs are HTTPS; the voice bridge uses WSS to Twilio and to the AI engines.
- Encryption at rest. Firestore and Cloud Storage use Google-managed encryption. OAuth tokens and Twilio subaccount credentials are encrypted with AES-256-GCM in an application vault keyed from Secret Manager.
- Tenant isolation. Every Firestore path is company-scoped; security rules default-deny and pin writes to the signed-in member’s company. Server APIs derive company identity from the verified Firebase ID token — never from the client body.
- Access control. Role-based capabilities for tenants; platform staff require an allowlisted email, a live admin document, and MFA (TOTP). Privileged session loss (member removal, admin demotion) revokes refresh tokens.
- Signed webhooks. Twilio, Stripe, Calendly, and Meta lead webhooks verify signatures and fail closed on mismatch.
- Audit logging. Tenant and platform audit trails are append-only; sensitive exports and deletions are logged. Tenant audit history is archived before a company purge.
- Backups. Firestore point-in-time recovery and daily backups with retention. Storage versioning and Auth export schedules are part of our DR runbook.
- Monitoring. Uptime checks on the voice bridge and alert policies for backend errors and payment webhook failures.
3. Subprocessors
Customer data may be processed by the vendors listed in our Privacy Policy and DPA:
- Google Cloud / Firebase — Cloud hosting, databases, authentication, and file storage (United States)
- Twilio — Telephony, phone numbers, SMS delivery, and A2P campaign registration (United States)
- OpenAI — Real-time speech, transcription, and language-model processing for AI features (United States)
- xAI — Optional alternate real-time voice engine for AI phone answering (United States)
- Stripe — Payment processing, subscriptions, and billing (United States)
- Resend — Transactional and notification email delivery (United States)
4. Compliance status (honest)
- SOC 2. We are building toward a SOC 2 Type I/II attestation (access control, change management, logging, vendor review). We are not SOC 2 certified today — do not treat this page as an audit report.
- HIPAA. The Service is not marketed as a HIPAA product. If you are a covered entity and need a Business Associate Agreement, contact legal@coserve.ai before sending protected health information — we will only process PHI under a signed BAA and with vendor BAAs in place.
- Call recording consent. The AI discloses a recorded/transcribed line at the start of calls; customers remain responsible for state wiretap / two-party consent compliance for their industry and geography (see our Terms).
5. Your controls
- Self-serve data export and a verified deletion request (processed within 30 days) live in the tenant app under Settings → Data & privacy.
- Security questions and vulnerability reports: legal@coserve.ai.