Security

Every Switchboard-scoped table in Avox's database is gated by a row-level security policy, not just an application-layer check - enforced by the database itself, on every query. No client can read or write another Switchboard's data by guessing an ID or crafting a request; the database refuses it regardless of what the application code does.

Everyone in a Switchboard is an Admin or a Manager, and an Admin can switch individual permissions on or off for each Manager - for example, who can see full phone numbers, manage billing or create API keys. Those permissions are checked on our servers for every request and again by the database, and the dashboard only shows people what they're allowed to use.

Customer phone numbers are stored encrypted and are only decrypted on our servers, when they're needed - they can't be read in plain text from the browser or from a copy of the database. Contacts are matched using a one-way fingerprint of the number, so finding or de-duplicating a contact doesn't require decrypting it.

Sign-in sessions live in secure, short-lived cookies scoped to Avox and are refreshed automatically. A strict Content Security Policy limits which scripts can run on our pages, you get an alert when a new device signs in, and you can see every active device and sign out all the others from Settings at any time.

You can sign in with a passkey - Face ID, Touch ID, Windows Hello or a security key - instead of a password, and add two-factor authentication with an authenticator app. Once it's on, every sign-in asks for a code from that app, whether you signed in with a password, a passkey, Google or Facebook, and so does resetting your password.

Creating, rotating or revoking an API key, and pausing or deleting a Switchboard, each ask for a 6-digit code we email to you. A code works once, only for that person, Switchboard and action, and expires after 10 minutes; a few wrong tries lock it. Removing a WhatsApp number is confirmed with a code sent to the Switchboard's owner.

Each Avox API key belongs to one WhatsApp number and is shown only once - we keep just a one-way fingerprint of it. Test keys run every check without sending anything, and rotating a key lets the old one keep working for a short overlap you choose, so you can swap it without downtime. Messages we forward to your own server are signed with a secret only you hold, with a timestamp in the signature, so your server can check each one came from Avox and reject replays.

Every connection to Avox - the dashboard, the API, and every webhook we receive - runs over HTTPS/TLS. Nothing is ever accepted or served over a plain, unencrypted connection.

Staff access to Avox's internal admin tools is restricted to a specific role, and that restriction is enforced in two independent places - once by the admin application itself, and again by the database directly. A mistake in one wouldn't be enough on its own to expose your data through the other.

Every webhook and data-deletion request from Meta carries a signature, and we check it before anything is written to our database. A request without a valid signature is rejected outright, so nobody can forge one and inject fake message or status data into your account. Payment notifications from PayPal are checked with PayPal itself before we act on them.

Avox never sees or stores your card or bank details - you enter them with PayPal. Every charge (your plan, and the early-cancellation fee on a Yearly plan if it applies) is processed by PayPal. Prices are set on our servers, never taken from your browser, and each payment is checked against the plan, amount, and currency we expected before your plan changes. We keep only the PayPal reference, amount, and status of each payment.

Checkout and payment steps, coupon and gift-code checks, invitations, verification codes, message sending, contact forms, and other public endpoints are rate-limited, so repeated guessing or flooding is slowed down and refused. Automation credits are capped per plan and tracked per Switchboard, so a runaway or misconfigured automation can't rack up unlimited WhatsApp message costs on your account - it stops sending once the period's credit balance is used up.

We look out for misuse of free plans, coupons, offers and payments, using short-lived security records and signs that accounts may be connected. Anything flagged is reviewed by a member of our team, who decides what, if anything, to do; nothing is restricted automatically. Security records are kept for a short time, only a few authorised staff can see them, and their access is logged. Our Privacy Policy explains what is kept.

Our public status page shows every Avox service, re-checked while you watch, with 90 days of history and any incidents we post. A separate Meta / WhatsApp section shows how WhatsApp itself is doing, so you can tell straight away which side an issue is on.

If you believe you've found a security vulnerability in Avox, please email hello@theavoxai.com with details before disclosing it publicly. We'll acknowledge the report and work with you on a timeline to fix it.