Security

Your ElevateBox account holds your business details, your leads’ phone numbers, and the recordings, transcripts and summaries of your calls. This page describes, in plain terms, how we look after them. It is a description of our practices, not a certification.

Our website, dashboard and APIs are served only over HTTPS, so data travelling between your browser and ElevateBox is encrypted. Our connections to our database and providers are encrypted too.

• Passwords are stored only as salted hashes — we never see or store your password itself. Where it is offered, you can sign in with Google instead.
• Sign-in, sign-up and password-reset requests are rate-limited to slow down abuse.
• Every lead, call, recording and transcript belongs to one account, and the Service only shows it to people signed in to that account.
• Inside ElevateBox, access to customer data is limited to the few people who need it to run and support the Service.

Payments are handled by Razorpay. Your card, UPI and bank details are entered with Razorpay and never reach our servers. Your wallet is only credited after we verify Razorpay’s signed confirmation of the payment.

Recordings we store are deleted automatically 90 days after the call. You can ask us to delete a recording, or your whole account, sooner by emailing [email protected]. Transcripts and summaries stay with your account until you ask us to delete them or close your account.

Like most online services, we rely on specialist providers. They process data only to provide their service to us. By category, they are:

• Cloud hosting
• Database and file storage
• Payment processing (Razorpay)
• Email delivery
• Telephony, which connects calls to the phone network
• Speech and language-model providers, which power the conversation, transcription and summaries
• Website analytics, where switched on (see our Cookie Policy)

Our Privacy Policy explains how personal data is used and shared.

If you think you’ve found a security problem in ElevateBox, or that your account has been accessed by someone else, email [email protected] straight away with as much detail as you can. Please don’t access other people’s data or disrupt the Service while investigating.