Security & privacy
Translation that protects what you say
Client-side encryption by default. GDPR data export and deletion. Managed cloud and fully on-premises deployment paths. HIPAA controls - BAA-backed onboarding, 6-year audit retention, and zero PHI in application logs - apply to accounts approved for healthcare use under a signed Business Associate Agreement.
E2E
Signal Protocol messaging
BAA
HIPAA controls under a signed BAA
6yr
Audit retention
On-prem
Deployment option
Eight pillars
Vavus AI was built for healthcare and enterprise from day one. Consumer features inherit the same encryption baseline.
Client-side encryption by default
New stored history, documents, and audio are encrypted on your device before storage. Messaging uses end-to-end encryption, with exactly two exceptions that you have to opt into: group polls, which the server must read to tally votes, and voice messages you ask us to translate, which require your recorded consent. Live speech is processed briefly in memory for speech input, translation, and spoken output before storage rules apply.
HIPAA controls under a signed BAA
Healthcare customers onboard under a Business Associate Agreement after review. Those accounts get 8-hour token expiry, 15-minute idle timeout, secure deletion of PHI assets, zero PHI in application logs by design, and 6-year audit retention. These protections apply only to accounts approved for healthcare use; a Personal account is not a HIPAA workflow and must not be used for PHI.
GDPR-ready by default
Authenticated data export. Account deletion endpoint. Granular cookie consent on the web, with the Global Privacy Control honored. Consent state tracked per user. First-touch attribution captured only after consent.
Managed cloud and on-premises deployments
In addition to the Vavus cloud on managed cloud, regulated buyers can review a dedicated managed cloud deployment or a fully on-premises install with no outbound network calls.
Audit trail retained 6 years
Audit logs record metadata-only events (who did what, when, from which device) and are retained for 6 years to support HIPAA and enterprise compliance reviews. Logs never contain PHI or translation content.
Strong account security
JWT auth with rotating tokens, separate stream tokens for WebSocket sessions, SAML 2.0 SSO for Enterprise, brute-force protection with exponential backoff, token revocation on logout and password change.
Breach detection and notification
Unusual activity, location changes, and IP anomalies are flagged. Suspicious sessions are challenged or revoked. Account lockout protects against credential stuffing. If a breach affects your personal data we notify you and the relevant authorities without undue delay and within 72 hours of confirming it, as the law requires.
Self-hosted support chat
Support chat on vavusai.com is answered by our own Vavus Concierge agent, with a person from our team taking over in our self-hosted helpdesk when needed. Support transcripts are not handed to a third-party vendor.
Account types and controls
Personal, Healthcare, and Enterprise accounts share the same encryption baseline. Healthcare and Enterprise add stricter controls on top.
| Account type | Session controls | Additional controls |
|---|---|---|
| Personal | 30-day token expiry | Standard features. End-to-end encrypted messaging. Client-side encrypted history and documents. Not a HIPAA workflow - do not use a Personal account for protected health information. |
| Healthcare | 8-hour token expiry, 15-minute idle timeout | Requires approved onboarding and an executed BAA. Medical speech recognition, on-premises deployment option, audit logging, no PHI in logs, secure deletion of PHI assets, 6-year audit retention. |
| Enterprise | 30-day token expiry (or org policy) | Full audit logging and export, SAML 2.0 SSO, organization management, regional data residency, managed cloud deployment path, and on-premises deployments. |
High-intent trust pages
Shorter pages for buyers searching specific privacy, healthcare, and encryption questions.
Privacy Mode & Data Retention
Zero data retention for unsaved live content, or encrypted history when you choose to save it.
Data Controls
History sync modes, local storage, deletion, exports, provider handling, and healthcare controls.
End-to-end encrypted translation
A precise breakdown of Signal messaging, client-side encrypted storage, live processing, and on-prem options.
HIPAA compliant translation app
Evaluator answers for BAA, PHI logging, healthcare account controls, audit retention, and deletion.
Medical interpreter app
Clinical translation workflows with medical speech recognition, BAA-backed onboarding, and human-review guardrails.
Concrete technical controls
The protocols, controls, and primitives Vavus AI uses today. This list is the citable detail behind the high-level claims above. What we do not currently claim, and will not imply: we hold no SOC 2 or ISO 27001 certification, we publish no third-party penetration test report, we offer no contractual uptime SLA on self-serve plans, and we publish no cyber insurance certificate. Enterprise and healthcare buyers can ask us where each of those stands before they sign.
- Client-side encryption for history, documents, and audio
- End-to-end encryption for messaging
- AES-256-GCM (legacy server-side, read-only for older content)
- TLS 1.2+ at the load balancer
- Cloud Armor WAF (500 req/min, 60s ban, XSS and SQL injection blocking)
- Per-user Account Master Key in device Keychain wrapping per-artifact keys
- JWT auth + separate stream tokens for WebSocket sessions
- SAML 2.0 SSO (Enterprise)
- Brute-force protection with exponential backoff and account lockout
- Token revocation on logout and password change
- Breach detection (unusual activity, location, IP anomalies)
- Secure deletion (overwrite before unlink) for PHI assets
- Audit logs retained 6 years (Cloud Logging + GCS lifecycle)
Request security documentation
Healthcare and enterprise teams can request the full security documentation pack - encryption architecture diagrams, key management, audit log schema, deployment topologies, BAA template, and DPA template with the named sub-processor list.
Frequently asked questions
Is Vavus AI encrypted end-to-end?+
Messaging is end-to-end encrypted, with exactly two exceptions, both of which require you to use the feature: group polls, because the server has to read a poll to tally votes and show results, and voice messages you ask us to translate, because translating one requires decrypting that message on our servers - we ask for your consent first, record it, and audit the access. Translation history, documents, and audio uploads are encrypted client-side before leaving your device, so the server stores only ciphertext for new content. Real-time speech translation is briefly plaintext in memory during the speech-input and spoken-output processing steps, then encrypted before storage.
Does Vavus AI sign a Business Associate Agreement?+
Yes, for approved healthcare customers after review. Contact constantine@vavusai.com or request review from the Healthcare page. Once a BAA is executed, your account uses 8-hour token expiry, 15-minute idle timeout, secure deletion of PHI assets, medical speech recognition, 6-year audit retention, and zero PHI in application logs. Until a BAA is executed, an account is not a HIPAA workflow and must not carry PHI.
Where does Vavus AI host my data?+
The standard Vavus cloud runs across US (primary), EU (edge), and Asia (edge) regions behind a global load balancer. Transfers out of the EEA, the UK, or Switzerland rely on the European Commission Standard Contractual Clauses (Decision 2021/914) together with the client-side and end-to-end encryption described above. Enterprise customers can review a dedicated managed cloud deployment or a fully on-premises install in their own data center.
Can I export my Vavus AI data?+
Yes. Authenticated users can request a full data export through the data export endpoint. The export includes your profile, history, messaging metadata, billing records, and consent state - encrypted at rest with your own encryption keys for items that were stored encrypted.
How long does Vavus AI keep my data?+
Content you do not save is not retained. Saved content stays until you delete it or close your account. Billing and tax records are kept 7 years, security and fraud logs 12 months, support conversations 24 months, and account records up to 30 days after closure. Healthcare audit log entries are retained 6 years to support HIPAA and enterprise compliance reviews; these contain metadata only - user actions and timestamps - not PHI or translation content. The full table is in Section 7 of the Privacy Policy.