Trust

Security and trust

Encryption, residency, access control, and the documents buyers ask for before they buy a reporting channel.

Last updated 2 November 2026.

Vox encrypts reports in the browser before they are stored. Vox holds ciphertext and does not hold the keys that can read case content. Staff sign in with a passkey and TOTP. Data, backups, and processing are hosted in the European Union (Frankfurt) on Render. Reporter IP addresses are not stored with the report. The facts in a report can still identify someone.

What buyers usually need to see

Privacy noticeHow personal data is handled for reporters and staff. Data processing agreementArticle 28 UK GDPR controller / processor summary. Sub-processorsCurrent register of processors used to run the service. Vulnerability disclosureHow to report a security issue to security@vox.uk. Browser-side encryptionWhat is encrypted, who holds keys, and honest limits. Handler exclusionHow a reporter can keep a named person off a case.

Security summary

Encryption: X25519-XSalsa20-Poly1305 via libsodium. Reports are encrypted in the browser.
Case key: 256-bit key shown once to the reporter. The server stores a hash for lookup, not the key.
Staff authentication: Passkey required, with TOTP as backup.
Residency: Frankfurt (EU). Data, backups, and processing are hosted in the EU on Render.
Audit: Tamper-evident, hash-chained log of staff actions, not plaintext report content.

What a subscription does not claim

A Vox subscription is a reporting channel. It does not certify that an employer is compliant with the Worker Protection Act 2023, PIDA, or UK GDPR. Organisations should take their own legal advice.

Read the short encryption guide, or see annual pricing.

How encryption works Pricing