Security You Can Trust
At Norvoxy, security isn't just a feature — it's the foundation of everything we build. We employ industry-leading security practices to protect your most sensitive conversations.
Enterprise-Grade Security
Comprehensive security controls designed for the most demanding enterprise environments.
Zero-Access Architecture
We never store or retain customer conversation data. Our platform processes information in real-time without persistent storage, ensuring your sensitive data never leaves your control.
End-to-End Encryption
All data transmitted to and from our platform is encrypted using TLS 1.3. Data at rest is encrypted using AES-256 encryption with customer-managed keys available.
SOC 2 Type II Ready
Our security controls are designed to meet SOC 2 Type II requirements. We are currently undergoing the certification process with an independent auditor.
GDPR Compliant
Our platform is designed from the ground up to help you meet GDPR and UK data protection requirements with comprehensive audit trails and data handling controls.
Multi-Factor Authentication
Enterprise SSO integration with support for SAML 2.0 and OIDC. MFA is enforced for all accounts with support for hardware security keys.
Continuous Monitoring
24/7 security monitoring with automated threat detection, anomaly identification, and real-time alerting. Our security team responds to incidents promptly.
Certifications & Compliance
Independently verified and continuously maintained compliance with industry standards.
SOC 2 Type II
In ProgressAnnual third-party audit of security controls
ISO 27001
PlannedInformation security management system
GDPR
CompliantEU General Data Protection Regulation
UK GDPR
CompliantUK data protection requirements
Cyber Essentials
In ProgressUK Government-backed certification
ICO Registration
RegisteredInformation Commissioner's Office
Need our security documentation? Request our SOC 2 report, penetration test summary, or security questionnaire responses.
Request DocumentationSecurity Practices
A comprehensive approach to security across development, infrastructure, and operations.
Secure Development Lifecycle
- Security requirements integrated from design phase
- Automated security testing in CI/CD pipeline
- Regular code reviews with security focus
- Dependency scanning and vulnerability management
- Penetration testing by third-party security firms
Infrastructure Security
- Deployed on enterprise-grade cloud infrastructure
- Network segmentation and micro-segmentation
- Web Application Firewall (WAF) protection
- DDoS mitigation and traffic analysis
- Automated security patching and updates
Access Controls
- Role-based access control (RBAC)
- Principle of least privilege enforcement
- Just-in-time access for sensitive operations
- Comprehensive access logging and auditing
- Regular access reviews and recertification
Incident Response
- 24/7 security operations center
- Documented incident response procedures
- Regular tabletop exercises and drills
- Customer notification within 72 hours
- Post-incident analysis and remediation
Responsible Disclosure Program
We value the security research community and welcome responsible disclosure of security vulnerabilities. Our program offers recognition and rewards for valid reports.
In Scope
- norvoxy.com web application
- api.norvoxy.com endpoints
- Authentication and authorization
- Data exposure vulnerabilities
- Business logic flaws
Out of Scope
- ×Social engineering attacks
- ×Physical security testing
- ×Denial of service attacks
- ×Third-party applications
- ×Recently patched vulnerabilities
Questions About Security?
Our security team is available to discuss your specific requirements, answer questions, and provide documentation for your vendor assessment process.