Your clients’ conversations,
handled like privileged material.
ClaimVox processes intake calls, medical updates, and case facts for plaintiff firms. The controls below are contractual — they are committed in Exhibit A of our Master Services Agreement, not just described on this page.
Data protection
- Encryption in transit. Customer data traversing public networks is encrypted using industry-standard transport encryption.
- Encryption at rest. Call audio, transcripts, and structured intake data are encrypted at rest using industry-standard symmetric encryption.
- Matter-level segregation. Your data is logically segregated from other firms’ data and from our own operational data. One client’s information is not reachable through another client’s workflows.
- You own your data. Your CRM data, recordings, and transcripts remain yours. Our license to use them is limited to operating the service for you.
Your data does not train public AI models
Call audio, transcripts, and CRM data from your firm are never used to train public AI models. We use your data to operate and improve the specialists your firm has deployed, and to compile de-identified aggregate statistics that cannot identify you or your clients. This commitment is in our Terms, our Privacy Policy, and our Master Services Agreement.
Access control
- Least privilege. Access to systems and customer data is restricted to personnel with a documented business need, granted on a least-privilege basis.
- Reviewed and revoked. Access is reviewed at least annually and revoked promptly on role change or departure.
- Personnel obligations. Everyone with access is bound by written confidentiality obligations and receives role-appropriate security and privacy training at least annually.
Network and infrastructure
- Firewalls, segmented production environments, and monitoring of administrative activity.
- Security patches applied on a risk-prioritized cadence.
- Backups performed for operational continuity, with a business continuity and disaster recovery plan and restoration testing.
Vendors and subprocessors
Delivering voice AI requires third-party infrastructure — telephony, speech recognition, language models, e-signature, and CRM connectors. Where we engage a third party to process your data, that vendor is bound by written obligations no less protective than our own commitments to you.
We treat underlying voice and model providers as replaceable infrastructure and may substitute one for another, provided the service remains materially equivalent in function, accuracy, and safety. Request our current subprocessor list.
Incident response
- We maintain a written incident response plan.
- On discovery of a confirmed security breach affecting your data, we investigate and contain promptly, notify you, and cooperate with your own notification obligations.
Built for regulated practice
- Attorney review. ClaimVox gathers and organizes information. Attorney review is required before any output is filed, produced, or relied on.
- Consent and disclosures. Your approved disclosures run on every interaction. Consent is captured, logged, and refreshed; opt-outs propagate across campaigns.
- Supervision-ready records. Recording, transcript, and audit trail on every call, for supervision, QA, and ethics review.
- Documentation for your ethics committee. An AI Use & Security reference and optional client-disclosure language are available on request.
Responsible disclosure
If you believe you have found a security vulnerability in ClaimVox, we want to hear from you. Please report it to [email protected]. We will acknowledge your report and keep you informed as we investigate. We ask that you give us a reasonable opportunity to remediate before public disclosure, and that you avoid accessing or modifying data belonging to our clients or their clients.
Questions from your IT
or ethics committee?
We complete security questionnaires, share our AI Use & Security reference, and will speak with your counsel directly.