We're holding the phone. We take that seriously.
Every call Avenora answers is encrypted, retained per policy, and attributable in our audit log. Here's what that means in practice.
Encryption everywhere
TLS 1.3 for every call leg and every dashboard request. AES-256 at rest for transcripts, audio, and database tables. Keys rotated quarterly via a dedicated KMS.
TCPA-aware dialing
Every cold-outreach number is scrubbed against the federal DNC + state DNC lists pre-dial, with calling hours validated against the prospect's local timezone. Demo calls you request from our site are different: they dial immediately because you asked for the call and gave express consent.
Recording retention by intent
Emergency calls (gas, CO, no-heat-in-winter) retained 7 years for liability records. Non-emergency calls retained 90 days. Per-shop deletion on request.
Recording disclosure
Every call opens with a TCPA-compliant disclosure that recording is taking place and how to opt out. Disclosure language reviewed by an outside attorney quarterly.
Tenant-scoped access
Multi-tenant database with row-level security enforced at the Postgres layer. Customer dashboards cannot read another shop's data — even via misconfigured service tokens.
Audit logging
Every administrative action is timestamped and attributed. Founder-only access to production logs, with read-only audit replay available to customers on request.
Compliance posture
We publish the status of every framework we're working through — no aspirational badges.
- SOC 2 Type I
- Planned — ask us about current practices
- TCPA + state DNC
- Live — pre-dial scrubbed
- PA wiretap consent
- Live — all-party disclosure
- HIPAA posture
- Adjacent — no PHI stored or processed
- Stripe PCI scope
- SAQ A (hosted Checkout, no card data ever)
Report a vulnerability
If you find something — anything — write to security@avenora.ai with reproduction steps. We acknowledge within 24 hours, fix in accordance with the severity, and credit responsible researchers in the changelog.
Email security@avenora.ai