Security & Trust

Last updated: October 18, 2026

VantaWeb answers phones, messages, and bookings for real businesses, which means customers trust us with their call recordings, contact details, and schedules. This page describes how we protect that data in production today — not aspirationally. If a practice changes, this page changes with it.

Infrastructure and hosting

VantaWeb runs on dedicated cloud servers hosted by Hetzner in Ashburn, Virginia (United States). All public traffic is fronted by Cloudflare, which provides DNS, CDN, TLS termination at the edge, and a web application firewall. Application services run in isolated Docker containers; host firewalls restrict every server to the minimum required ports, and internal telemetry travels only over a private WireGuard network.

Encryption

In transit: all connections use TLS — at the Cloudflare edge and on to origin servers. Plain-HTTP access is not served.
At rest (backups): every database backup is encrypted with modern authenticated encryption (age / X25519) before it leaves the origin server.
Payment data: never stored on VantaWeb systems at all — see payment security.

Backups and disaster recovery

We operate continuous database write-ahead-log archiving with point-in-time recovery, giving a recovery point objective of roughly five minutes, alongside daily encrypted full backups. Copies are stored off-site with a second provider (Backblaze B2) with 30-day version retention. Backup health is checked automatically every hour, and we run restore drills against real backups — most recently in July 2026 — because a backup that hasn't been restored is a hope, not a plan.

Access control

Administrative server access is limited to public-key SSH; there is no shared-password access.
Application containers follow least privilege — for example, no application container has access to the Docker control socket; container introspection for health checks goes through a dedicated read-only proxy.
Production secrets live in server-side environment stores, never in the codebase or client-side code.

Application and deployment security

All application code reaches production exclusively through CI/CD (GitHub Actions) — no manual builds on servers.
The main branch is protected: changes go through pull requests with automated review, including a dedicated security review pass.
Container images are scanned for known vulnerabilities on every build (Trivy); builds fail on fixable high-severity findings.
Deployed images are versioned with an immediate rollback path.
Security headers (HSTS, CSP, X-Frame-Options) are enforced on public surfaces.

Monitoring and alerting

Production is monitored with metrics-based alerting (host, container, database, and application-level), external uptime checks, and real-time alert delivery to the operations team. Alerting is tested against live metrics, not assumed.

Payment security (PCI DSS)

All payments are processed by Stripe, a PCI DSS Level 1 certified payment processor. Cardholder data is entered directly into Stripe-hosted fields and never touches VantaWeb servers, which qualifies VantaWeb for PCI DSS SAQ A self-assessment — the scope reserved for merchants who fully outsource card handling.

Data protection and privacy

How we collect, retain, and delete personal data is documented publicly:

Privacy Policy
Data Processing Agreement (GDPR Article 28 terms for customers)
Sub-processor list — with 30 days advance notice before any addition
Data retention policy — including call recordings and transcripts

Healthcare practices should read our current HIPAA and PHI boundary. VantaWeb is not currently offered for PHI or HIPAA-regulated workflows and does not currently execute BAAs.

These answers say what our phone software does and quote the laws they cite, with a link to each official text. They are not legal advice. Recording laws differ in scope and have exceptions this page does not cover, so ask a lawyer how they apply to your business.

Does VantaWeb record calls?

Not by default. Our voice software records call audio only when recording is switched on for an account. When it is on, Anna by default plays a notice before her greeting: “Just so you know, this call may be recorded for quality and training purposes.” Whether or not audio is recorded, Anna works from a text transcript of the call, and transcripts and call summaries are kept as our data retention policy describes.

Does Anna tell callers she is an AI?

Not automatically at the start of every call: by default Anna opens with the greeting and makes no AI announcement. Her instructions tell her never to claim to be human and, when a caller asks who she is, to say she is the AI receptionist for the business. A business can put an AI disclosure in the greeting set up for its account.

Who is on the line?

Anna, an AI receptionist. No human agents sit behind her: a caller reaches a person only if Anna transfers the call to a number the business has set up. Anna takes calls in English only.

What does federal law say about recording a call?

It allows a party to the call, or someone with one party’s prior consent, to intercept it: “It shall not be unlawful under this chapter for a person not acting under color of law to intercept a wire, oral, or electronic communication where such person is a party to the communication or where one of the parties to the communication has given prior consent to such interception unless such communication is intercepted for the purpose of committing any criminal or tortious act in violation of the Constitution or laws of the United States or of any State.” Source: 18 U.S.C. §2511(2)(d) (U.S. Code, 2023 edition, govinfo.gov). Some states require the consent of every party; see the next answer.

Which states require every party’s consent?

The statutes below use all-party wording for recording or intercepting some or all calls. Their scope differs: several cover only confidential or private conversations, or only secret or hidden recording. Other states’ laws are worded differently, and this list is not a complete survey. Each quote was checked against the official text on 18 October 2026.

State	Statute	Wording
California	Cal. Penal Code §632(a)	“without the consent of all parties to a confidential communication”
California	Cal. Penal Code §632.7(a)	“without the consent of all of the parties to a communication” (calls involving a cellular or cordless telephone)
Connecticut	Conn. Gen. Stat. §52-570d(a)	“consent of all parties to the communication” (private telephone calls; the section also accepts a verbal notification recorded at the beginning, or an automatic warning tone)
Florida	Fla. Stat. §934.03(2)(d)	“when all of the parties to the communication have given prior consent”
Illinois	720 ILCS 5/14-2(a)(2)	“with the consent of all other parties to the private conversation” (recording in a surreptitious manner)
Maryland	Md. Code, Cts. & Jud. Proc. §10-402(c)(3)	“all of the parties to the communication have given prior consent”
Massachusetts	Mass. Gen. Laws ch. 272, §99(B)(4)	“prior authority by all parties to such communication” (secret recording)
Montana	Mont. Code Ann. §45-8-213(1)(c)	“without the knowledge of all parties to the conversation” (recording with a hidden device; subsection (2)(a)(iii) exempts persons given warning of the transcription or recording)
New Hampshire	N.H. Rev. Stat. §570-A:2, I	“without the consent of all parties to the communication”
Pennsylvania	18 Pa.C.S. §5704(4)	“where all parties to the communication have given prior consent”
Washington	Rev. Code Wash. §9.73.030(1)(a) and (3)	“without first obtaining the consent of all the participants in the communication” (private communications; subsection (3) treats consent as obtained when one party announces, in any reasonably effective manner, that the call is about to be recorded, and the announcement is recorded)

Compliance status

PCI DSS SAQ A: self-assessed; card handling fully outsourced to Stripe.
CAIQ (CSA Cloud Controls Matrix): no completed, approved CAIQ is represented as available by this page. Request current status from security@vantaweb.io.
Security questionnaires: requests are reviewed individually; scope, evidence availability, and turnaround are confirmed in writing.
SOC 2: not yet certified; on our roadmap as customer demand warrants. This page and the documents above describe the controls we operate today.

Coordinated vulnerability disclosure

We welcome good-faith security research. If you believe you've found a vulnerability in a VantaWeb service, email security@vantaweb.io with enough detail to reproduce the issue. Machine-readable contact details are published at /.well-known/security.txt (RFC 9116).

Scope: vantaweb.io and its subdomains (app, api, partners), and the VantaWeb chat/voice widgets.

Out of scope: denial-of-service or volumetric testing, social engineering or phishing of staff or customers, physical attacks, spam, and findings on third-party services we don't operate (report those to the vendor).

What we commit to:

Acknowledgement within 3 business days.
An assessment and remediation timeline once the report is validated.
Credit for the finding if you'd like it, once fixed.

Safe harbor: we will not pursue or support legal action against researchers who make a good-faith effort to follow this policy — accessing only what is necessary to demonstrate the issue, avoiding privacy violations and service disruption, and giving us reasonable time to remediate before public disclosure. We do not currently operate a paid bug bounty.

Questions

Security questionnaires, CAIQ requests, subprocessor questions, or anything else on this page: security@vantaweb.io.