Encryption and keys

Everything Proxara keeps is encrypted where it is kept and wherever it moves.

At rest

The app’s data sits on encrypted Amazon storage. A call’s record, with its transcript and what the model wrote, is sealed again with AES-⁠256 under a key held in AWS Secrets Manager, and so is the token for an officer’s Monday board. Contacts, leads and the facts a call established carry the storage’s encryption alone.

A connected install keeps its data in Azure Storage, encrypted with 256-bit AES, with infrastructure encryption adding a second layer under it and no public access.

In transit

Every connection uses TLS 1.2 or higher: the app to Proxara, Proxara to its storage, and Proxara to the phone line, to Microsoft, to Apple and to Monday. Proxara’s address answers only on HTTPS, redirects plain HTTP, and tells every browser to use HTTPS alone from then on. The call itself crosses the phone network, which Proxara can’t encrypt.

Keys and secrets

The phone line’s key, the key that seals call records and the keys for email and notifications are held in AWS Secrets Manager, never in code, in git or in the app’s settings. A connected install holds its secrets, the Teams bot’s and the CRM’s among them, in Azure Key Vault. The credit vendor’s password is never held at all: credit is ordered through Encompass on the lender’s own accounts.

Social Security numbers and dates of birth

On a kept call, the model reads them with the rest of the words. Proxara then masks them in the transcript, summary and notes wherever it finds them, and a Social Security number’s last four digits stay. The whole value stays in the call’s sealed record for 14 days, shown only behind Face ID or a code sent to the officer’s sign-in address, and is then erased. It never goes in an email, a notification, Monday or a log.

In a connected install they go from the call straight into Encompass, and Proxara then keeps only a Social Security number’s last four digits and nothing of a date of birth. They are never asked for by text, and one texted anyway is kept as its last four digits only.