Trust & Security
Last updated: August 16, 2026
Security is built into how Nixflex works, not bolted on afterwards. This page explains, in plain terms, how we protect your data and your callers. Everything on this page describes controls that exist and run today - nothing aspirational.
1. How is my account isolated from other customers?
Every table in our database enforces row-level security: your API key can only ever read or write rows that belong to your account, and that rule is enforced by the database engine itself, not by application code that could have a bug. Billing balances and call records go further - they cannot be modified from outside our billing engine at all, even by you. Your invoices are computed from records that nobody, including a compromised browser session, can tamper with.
2. Who can access my data?
You and your team, authenticated with your own API key - and that is the list. Administrative access on our side requires server-side identity verification against a fixed operator account; privileged database credentials exist only in server code and never reach a browser. Dashboard accounts support two-factor authentication with a backup authenticator. We never sell your data, share it with third parties for their own use, or use your calls to train models.
3. Encryption everywhere
Every call and every request is encrypted. Live audio streams over secure WebSocket (WSS) and HTTPS while a call is in progress. Stored recordings and transcripts are encrypted at rest using AES-256. All API traffic uses TLS, with strict transport security enforced on every response.
4. Where is my data?
Call data, recordings, and transcripts are stored on EU infrastructure (Ireland), encrypted at rest, and automatically deleted 90 days after each call. The database is backed up automatically every day with a rolling recovery window, so an operational mistake on our side is recoverable. Live calls are processed in real time by carefully selected technology providers under data protection agreements - our Privacy Policy explains exactly how data is processed, and a DPA is available for customers who need one.
5. Can I delete data - and can we leave?
Yes, instantly, and without asking us. Delete any single call - its record, transcript, and recording file - with one API request, or erase all call data on your key at once from the API or the dashboard. Deleting your account purges your calls, recordings, and messages before the login is removed; billing records are retained as required by tax law. Your transcripts and recordings are retrievable through the API at any time before deletion, and your phone numbers stay in your own Twilio or Telnyx account throughout - there is no lock-in by design.
6. How do you prevent abuse of the platform?
Every API key has enforced per-minute rate limits with standard headers, so one customer's runaway script can never degrade another customer's calls. Account signup is protected against free-credit abuse: trials are granted once per person, signup requires a verified email address, and the key-creation endpoint is rate-limited per IP. Our servers send security headers on every response, reveal nothing about internal infrastructure, and never return stack traces or internal details in errors - failures are logged on our side and answered with clean, structured responses.
7. What happens if a provider fails?
The engine is built for graceful degradation. Speech recognition runs with an automatic mid-call failover to a second engine, voice synthesis has a standby engine, and the AI layer falls back across multiple providers if one degrades - all without the caller noticing. Your telephony stays in your own carrier account (Twilio or Telnyx), so your numbers are never hostage to us.
8. What happens if Nixflex goes down?
We publish a live status page with per-service uptime and our own permanent daily uptime history - not just a badge, real numbers you can check any day. The engine runs on redundant servers in the EU, and background jobs are designed so that a restart or deploy never loses scheduled work. When incidents happen, they appear on the status page from live monitoring data.
9. We never handle payments on calls
Nixflex does not take, store, or process card or payment details on a call. If a caller needs to pay, that happens through your own payment provider, never through our engine. Because card data never touches our systems, your Nixflex usage stays out of scope for PCI-DSS by design - one less compliance burden for you.
10. Webhooks you can verify
Every webhook we deliver is signed with a timestamped HMAC-SHA256 signature using your own secret, so your systems can verify that a delivery genuinely came from Nixflex and was not tampered with or replayed. Verification takes one line with our official SDK, or a few lines in any language.
11. Privacy by design
A Data Processing Addendum (DPA) is available for customers who need one under GDPR or UK GDPR - email us to request it. Our full Privacy Policy explains how we act as a processor and controller, and how to exercise your data rights.
12. On our roadmap
We are continuously strengthening our security posture, and our dependencies are monitored automatically for known vulnerabilities. Formal certifications such as SOC 2 are on our roadmap as we grow. We would rather tell you honestly where we are today than claim a badge we have not earned - if you have a specific compliance requirement, get in touch and we will tell you exactly what we can support.
13. Questions
Security questions, vendor assessments, or a DPA request? Email support@nixflex.com and we will help.