SECURITY BY DESIGN
Protection clients can verify.
AI Reception limits public access, collects only what is needed and treats AI output as unconfirmed input. Security is an ongoing process, so we do not promise absolute invulnerability.
MFA protection
Multi-factor authentication for administrator accounts where supported. Individual accounts, minimum permissions and no shared administrator login.
Private client portal
The operational dashboard is separate from the public website and requires personal account access.
Secure webhooks
Incoming Vapi messages require server authentication, an allowed assistant ID and a size-limited JSON payload.
Minimal data storage
Full transcripts and raw call artifacts are not stored by default.
Limited retention periods
Call and order data is deleted after 30 days by default; temporary sessions after one day.
Human oversight
An AI call can record a draft order, but does not independently make payments or perform irreversible actions.
Layered protection
HTTPS, browser security headers, input limits, tenant isolation and dependency scans reduce the attack surface.
Report a vulnerability
Confidentially report a suspected vulnerability to info@aireception.nl. Do not share customer data, perform denial-of-service attacks, or modify or delete data. We will acknowledge receipt and agree on safe next steps.
Last updated: 7 September 2026