Trust and security

1. Who operates VanVox

VanVox is operated by VANVOX LTD, a company registered in England and Wales under company number 17225704. Our registered office is Suite RA01, 195–197 Wood Street, London, E17 3NU.

You can independently verify the company on the Companies House register. VanVox is the name of the product and service; VANVOX LTD is the company accountable for it.

This page is effective from 24 July 2026 and was last reviewed on 24 July 2026.

2. What VanVox handles

Depending on how you use VanVox, the service may handle:

• account and business-profile details;
• WhatsApp identifiers and message metadata;
• typed messages you send;
• voice notes and the transcripts produced from them;
• the draft details extracted from your message or receipt;
• customer and supplier details you include;
• quotes, invoices and expenses;
• receipt images and generated PDFs;
• support, audit and security records needed to run the service safely.

The same underlying information can exist at different stages, and VanVox treats these differently:

• Source information — the original text, voice note or receipt image you send.
• Intermediate processing data — working data created while a request is processed, such as a transcript.
• Drafts — a proposed quote, invoice or expense you have not yet confirmed.
• Confirmed business records — the quotes, invoices and expenses you explicitly confirm and keep.

The full legal detail — categories, purposes, roles and lawful bases — lives in the Privacy Notice.

3. AI-assisted processing

VanVox uses AI to save you time: it supports transcription of voice notes and the structured extraction of details such as amounts, dates and line items.

• AI may make mistakes, so its output is treated as a draft, not a final answer;
• deterministic validation and clarifying questions are used to catch missing or unclear details;
• you review every draft before anything is finalised;
• quotes and invoices are not finalised without your explicit confirmation.

These checks are built into the software. This does not mean VanVox staff read every draft — the review and the final decision are yours. Our dedicated AI transparency statement explains how VanVox uses AI and how you stay in control in more detail.

4. Confirmation before finalisation

Explicit confirmation is a core trust control, not just a convenience:

• a message or voice note creates a draft;
• VanVox may ask you questions to fill gaps or resolve ambiguity;
• you can correct details before committing;
• an explicit confirmation is required before a quote or invoice is finalised;
• confirmed documents remain your business’s commercial records.

Nothing becomes a confirmed record until you say yes.

5. Security controls

VanVox implements a set of practical, high-level controls in the application today:

• authenticated dashboard access, so account features require signing in;
• server-side authorisation and tenant isolation, so a business only sees its own data;
• deduplication of inbound provider messages, so a repeated webhook is not processed twice;
• deduplication of outbound sends, to avoid duplicate messages to you;
• isolated, retry-safe background processing designed to be repeatable without side effects;
• encrypted transport (HTTPS) for the website and the provider connections we use;
• encryption of selected sensitive stored fields, such as bank details;
• security and audit event recording to help us detect and investigate problems;
• retention and deletion controls (see below);
• a privacy-safe logging design (see below).

We keep the specific details of our defences private so that publishing them does not make the service easier to attack. No online service can promise perfect security, and we do not claim to: we do not claim that all data is encrypted at rest, that using VanVox carries no risk, or that we operate to a specific uptime or incident-response service level during the beta. Our dedicated security statement explains these controls, and their honest limits, in more detail.

6. Privacy-safe logging

Our logging is designed to avoid capturing the content of your work:

• ordinary application logs are designed not to contain message bodies, transcripts or customer records;
• logs use safe identifiers, statuses, timestamps and short prefixes rather than raw content;
• security and audit records may be retained for operational reasons;
• failed background-job records have a bounded retention window and are pruned on a schedule.

Minimising the raw data that can be held in queued job payloads remains an area we continue to improve internally, and our retention controls are designed to bound how long such records can persist.

7. Storage, retention and deletion

• source voice and text artefacts are handled under configured retention schedules;
• receipt images are covered by automated retention, with an application default of 90 days;
• confirmed records may remain as your business records independently of the source artefacts that produced them;
• you can request deletion of your information at any time;
• backups and copies held by external providers may expire on separate cycles;
• we may need to keep limited information where the law or a legitimate operational reason requires it.

The 90-day figure is the application default; the effective period in a given deployment is set by configuration and has not been independently verified on this page. Deleting information removes it from the live service, but is not the same as immediate removal from every backup copy. We are honest about this rather than promising complete removal from every system at once. See the Privacy Notice and the data deletion instructions for details.

8. Service providers and international processing

VanVox relies on a small set of service providers to run the product:

• Meta operates the WhatsApp platform used to send and receive your messages and media;
• OpenAI processes audio and text to produce transcripts and extracted draft details;
• the specific hosting, storage, email and backup providers may vary by deployment and are described by category until confirmed.

Some processing may take place outside the United Kingdom. We are verifying exactly where each provider processes information and which transfer safeguards apply; those contractual and transfer details remain subject to human and legal verification where they are currently unresolved. The confirmed providers, category wording and the details still being verified are maintained in our subprocessor register, which is the single place we keep this list current rather than duplicating it here.

9. Security and incident reporting

If something looks wrong, please tell us. You can report:

• suspected account compromise or unauthorised access, to support@vanvox.co.uk;
• a privacy concern, to privacy@vanvox.co.uk;
• a suspected vulnerability or security issue, privately, to support@vanvox.co.uk;
• a deletion request, through the data deletion instructions;
• a formal legal notice, through the routes on our contact page.

When you report something, please do not send passwords, API keys, access tokens, full bank details, or unnecessary customer data. A short, redacted description of the affected page or feature is enough for us to begin. Full contact routes are on the contact page.

Support is handled on a reasonable-efforts basis during the beta. VanVox does not currently offer a formal SLA, guaranteed response time or round-the-clock support.

10. Beta and assurance limitations

• VanVox is a beta service, and its features and controls may evolve;
• no formal service level agreement (SLA) applies during the beta;
• VanVox is not approved or endorsed by HMRC;
• VanVox does not currently submit tax returns or Making Tax Digital (MTD) filings on your behalf;
• this Trust Centre is a transparency page, not a certification, audit result or guarantee.

11. Current assurance status

Core trust and privacy controls are implemented in the application. Some legal, provider-contract and production-configuration checks remain subject to final human verification. To keep this honest, we separate what is built from what is still being verified:

Repository controls implemented

The application-level controls described on this page — authenticated access, tenant isolation, deduplication, retry-safe processing, selected field encryption, privacy-safe logging, and retention and deletion controls — are implemented in the codebase and covered by automated tests.

Legal review outstanding

Our data-protection roles, lawful bases, terms and data processing arrangements reflect our current position and remain subject to final qualified legal review. They are not presented as legally concluded.

Deployment verification outstanding

Production configuration — including provider regions, retention values in the running environment, backup handling and mailbox operation — still requires operational verification and is not proven by this page.

Production-publication approval outstanding

Final publication of these positions as concluded assurances depends on the legal, provider-contract and deployment checks above being completed by the people responsible for them.

This is a plain-language status, not a live certification dashboard. It reflects an internal readiness review and will be updated as those checks are completed.