Where your data lives, and how it stays yours

Your knowledge base, conversations, and captured leads are stored in a managed PostgreSQL database, with vector embeddings of your content held in the same database. The API runs on a dedicated cloud host; the dashboard is served as a static site.

Source files you upload (PDF, DOCX) are not retained — text is extracted at ingestion and the original file is discarded. We store the extracted text and its embeddings, nothing more. Transient background work (crawling, embedding) passes through a short-lived job queue.

Billing runs through Stripe and transactional email through Resend; neither receives your end-users’ conversation content.

VOYCE uses OpenAI’s API platform (not consumer ChatGPT) for three things: generating embeddings of your content, answering visitor questions, and text-to-speech for voice replies.

For a given request, OpenAI processes the visitor’s question, the specific excerpts retrieved from your knowledge base to answer it, the recent turns of that conversation for context, and the response text sent for voice synthesis. Per OpenAI’s API terms, data submitted via the API is not used to train their models, with retention limited to abuse monitoring and zero-retention options available for eligible use. OpenAI’s DPA and subprocessor details are available on request.

OpenAI never sees: billing or payment data, database credentials, or any other organization’s data.

VOYCE is multi-tenant by design. Every stored record — documents, embeddings, conversations, leads — carries an organization identifier, and every data access is scoped to your organization on every request through authenticated tenant controls.

Your organization holds its own dedicated API keys; requests are authorized against those keys before any data is touched. Retrieval — including vector search over your knowledge base — is filtered by organization, so one tenant’s content can never surface in another tenant’s responses.

Visitor IP addresses are never stored with conversations. An IP is used transiently to resolve an approximate, city-level location for your analytics — the location is kept, the address is not written to your data.

Answers are grounded in your content and can cite the page they came from. When VOYCE isn’t confident it can answer from your content, it says so instead of inventing information — and the question is surfaced to you as a knowledge gap.