How Integovox handles your data.

Your data is your data.

The operational data you put into Integovox, work orders, assets, parts, donor records, whatever your module tracks, belongs to you. Integovox does not sell customer data or share it with third parties for their own purposes.

Essentials and Professional, isolated differently.

Essentials runs on shared infrastructure, with per-tenant access controls, and you get your own sign-in organisation (Zitadel). Your module data (units, work orders, inspections and the like) lives in your own schema and is never stored alongside another customer's in a shared table. Some platform records that the shared application layer keeps, such as user accounts, file details and activity history, are in shared tables, with per-tenant access controls. The one exception: outcome fields of assistant interactions (no question or answer text, no identifiers), described under AI interaction retention, may be combined across customers.

Professional adds full infrastructure isolation on top of that: your own dedicated VPS, so nothing about the server itself, its resources, its network, its containers, is shared with any other customer.

Zitadel identity, role-based access.

Integovox uses Zitadel, an open-source identity platform, to handle authentication and single sign-on. Every account gets role-based access control, so what a manager can see and do is scoped differently from a technician, a driver, or a shop-floor kiosk. Essentials customers get their own Zitadel sign-in organisation on a shared Zitadel instance; Professional customers get their own dedicated Zitadel instance.

Shared application layer, or dedicated server.

Essentials customers run on a shared application host, alongside other Essentials customers, each in its own schema of a shared database, with per-tenant access controls and its own sign-in organisation, as described above. Professional customers run on their own dedicated VPS: their own operating system, their own containers, their own resources, not shared with anyone else.

Automated, encrypted, and restore-tested.

Every server backing Integovox runs automated daily backups (Restic, encrypted on our servers before upload, to Backblaze B2). One copy is kept for 30 daily versions; a second copy is write-locked so that no one, including us, can delete or change it for 90 days; and a third copy is kept on a separate server that accepts new backups but cannot delete old ones. Every night an automated test restores each server's databases from backup and checks real record counts. Backup frequency and retention describe current infrastructure practice and may be adjusted as the platform grows.

Phoenix and the built-in AI read what they need to do their job, nothing more.

Phoenix and each module's built-in AI access your operational data only as required to provide the platform functionality you're using, answering a question, surfacing a record, or (for the built-in AI, within permissions you define) taking an authorized action. Neither reads data belonging to another customer, on either plan.

Your operational data is not used to train AI models.

Phoenix and the built-in AI work by reading your live data at query time to answer questions and take permitted actions. Your operational data itself (work orders, records, files) is not used to train models for other customers or for Integovox generally. The questions asked and answers given through our assistant are retained as described in the next section; only their outcome fields, with no text and no identifiers, may be used to improve the models used for all customers.

We keep assistant interactions to keep them accurate and safe.

To keep our AI assistant accurate and safe, we retain the interactions between our system functions and the assistant (questions asked and answers given). Once its automatic controls are in place, names and other identifiers are to be removed before storage, full records kept 12 months and then only outcome fields; only outcome fields with no text and no identifiers may be combined across customers to improve the models used for all customers, and a customer can opt out. Until then, records are stored with PINs, passwords, keys, email addresses and phone numbers redacted, are used only for that customer's own service, and are not combined with any other customer's data. Our assistant runs open-weight AI models that we run and adapt ourselves, on servers we administer: our application servers and a GPU server we rent, both listed on our Subprocessors page. These interaction records are kept on our own servers and are not sold or shared with third parties for their own purposes. A few features use outside AI services, listed on the same page, which receive only what that feature works on. Sensitive values such as PINs and credentials are automatically detected and redacted before storage.

Your data, portable on request.

Your operational data lives in a standard Postgres database. If you need a full export, whether for backup, migration, or any other reason, contact info@integovox.com and we'll provide one.

What happens when service ends.

When you cancel, we stop billing and begin deprovisioning your infrastructure. If you want a copy of your data, request an export before or immediately after cancelling, see Data Export above. We don't currently publish a fixed data-deletion timeline after cancellation; contact info@integovox.com if you need specifics for your account.