Security and trust

The company

• Voxa MTD Limited, company number 16984959.
• Registered office: 4 Allcroft Road, 4 Hillside Court, Reading RG1 5DJ.
• Registered with the Information Commissioner's Office: ZC113197.
• Security questions: hello@voxamtd.com.

Where your data is held

Our database, sign-in and file storage are hosted by Supabase in the EU (Paris). Some services we use to send messages and run the AI assistant process data in the United States. Each one, what it does, where it runs and the safeguard it relies on is listed on our sub-processors page. We give you at least 30 days' notice before we add or replace one.

Data is encrypted in transit (TLS) and at rest by our hosting providers.

How your records are kept apart

Each agency's records are kept apart by row-level security: access rules in the database itself, so one agency cannot see another's.

Inside your agency, roles decide who can see and change what: owner, admin, manager, viewer and auditor. Manager and viewer seats can be limited to their own branches, and the same database rules then keep other branches' properties, jobs and certificates from them. See multi-branch agencies.

Owners and admins can see a log of who changed what and when, filter it and export it. This log is separate from the sealed record below.

Sign-in and your data

• Each person signs in with their own account. Your owner or an admin invites new seats, and your owner can remove a seat at any time.
• Single sign-on with your own identity provider is not available yet.
• Owners and admins can download the agency's records at any time, as spreadsheet files, from Settings. Uploaded documents and photos are listed in the download, not included in it.

Your agreement with us

• Data processing agreement: your agency accepts it before we handle any tenant data. We are the processor; your agency is the controller.
• Terms of service for agencies.
• Privacy notice for tenants, and how to ask for data to be deleted.

How we use AI

• When certificates are read by AI, nothing is recorded as a certificate until a person ticks it.
• Alex suggests and people decide. Nothing is booked unless a person approves it, or a rule your team has set allows it.
• The AI services we use are named on the sub-processors page.

The record we keep

Each certificate you record, and the key steps of each repair, is linked to the entry before it by a digital fingerprint and date-stamped by an outside timestamping service. If an entry were changed later, the fingerprints would no longer match. Contractor messages and quotes are not in this record yet.

Certifications and insurance

• Certifications, we do not hold Cyber Essentials, ISO 27001 or SOC 2 certification yet. Our Cyber Essentials application is in progress; we will publish the certificate number here when it is issued.
• Insurance, ask us for our insurance details.

Ask us

We will answer your security questionnaire and walk your team through how Voxa Estate handles data. Book a call or email hello@voxamtd.com.