Convocart handles business phone calls and website chat sessions on behalf of our customers, which can include callers' personal information. Security and data protection are built into how the platform is designed and operated, not added afterward.
All traffic between callers, the Convocart dashboard, and our infrastructure is encrypted in transit (TLS). Call recordings, transcripts, and account data are encrypted at rest using our cloud provider's managed encryption.
Convocart is hosted on Google Cloud Platform, with a managed PostgreSQL database and a Redis-backed cache layer for tenant configuration, and runs on LiveKit's real-time voice infrastructure for both browser and phone calls.
Tenant dashboard access is role-based (tenant vs. admin) and protected by session authentication. Internal service-to-service calls (e.g. the voice agent calling back into our API to book an appointment or capture a lead) are authenticated separately from user-facing traffic. Administrative actions are recorded in an audit log.
Call recording is off by default and only enabled per business at that business's request. Where enabled, recordings are stored encrypted and are only accessible to that business's own dashboard users.
Convocart is SOC 2 Type II and GDPR ready — built with the encryption, access controls, and data minimization practices those frameworks require. We are not currently formally certified under either framework.
See our Privacy Policy for retention windows. Customers may request deletion of their account data at any time by contacting us.
If you believe you've found a security vulnerability in Convocart, please report it to hello@methuselahventures.ai. We investigate all reports and will work with you on responsible disclosure.
Convocart uses the following categories of sub-processors to deliver the service: speech recognition (Deepgram), text-to-speech (ElevenLabs), language models (Google Gemini / Vertex AI), voice and telephony infrastructure (LiveKit, Exotel), billing (Chargebee, via Stripe or Razorpay), and cloud hosting (Google Cloud Platform).