Security & Data Protection

We build systems that sit inside other companies' phone lines, inboxes, and books. That only works if the security posture is boring, explicit, and verifiable. This page describes how we handle security — plainly, without badges we haven't earned.

1. Principles

• Least privilege. Agents and our team get the narrowest access that the workflow needs — scoped API keys, role-limited accounts, nothing shared.
• Client-owned infrastructure. Deployments run in accounts the client controls wherever possible. You can revoke our access at any time without breaking your ownership of the system.
• Explicit boundaries. Every agent has a written definition of what it may do, what it must never do, and when it must hand off to a human. Consequential actions get human sign-off gates.
• Auditability. Agent actions are logged. Transcripts, decisions, and writes to client systems are traceable after the fact.
• No training on your data. We do not use client conversation data to train models of our own, and we configure model providers' no-training/zero-retention options where available.

2. The website

• Served exclusively over HTTPS with HSTS; static pages on a global CDN (Netlify), which absorbs traffic spikes and denial-of-service noise by design.
• Security headers: X-Content-Type-Options, X-Frame-Options, Referrer-Policy, and a restrictive Permissions-Policy.
• Cookieless analytics — nothing is stored on your device; no third-party ad scripts anywhere on the site.

3. Client engagements

• Credentials are exchanged through secure channels and stored in a password manager with access limited to the people on your engagement.
• Data in transit between agents and your systems is encrypted (TLS). Where a workflow stores data at rest, it lives in your systems, under your retention rules.
• We work to GDPR-aware practices and, for healthcare-adjacent deployments, design within the client's compliance framework (for example limiting what an agent may hear, store, or write). We state plainly what we are not: we are a young studio and do not yet hold SOC 2 or ISO 27001 certification — the practices above are contractual commitments instead.
• Offboarding is clean: access revoked, credentials rotated by you, and everything we built stays with you.

4. Subprocessors for this website

Netlify (hosting), Cal.com (scheduling), PostHog EU (cookieless analytics), Supabase (blog contact form), and — only when a visitor starts the live demo — our voice platform provider. Client deployments document their own subprocessor list per engagement.

5. Reporting a vulnerability

Found something? Email contact@genovaflow.com with "SECURITY" in the subject. We read those first, we won't threaten good-faith researchers, and we'll tell you what we fixed.