Skip to content
Realtevo AI
Security

Security at Realtevo AI.

For technical buyers: what we build on and how we protect your data. Every statement on this page is verifiable in our code, our configuration or the named provider's public documentation.

Built on

Built on infrastructure you already trust.

The providers under Realtevo AI, and what each one does for your business. Text names only — we don't borrow anyone's badge.

Infrastructure

  • VercelHosting, TLS and encrypted environment store
  • GitHubPrivate source repository, deploy on push
  • CloudflareDNS for realtevoai.com

Data

  • TursoSQLite-based database, encrypted at rest (Turso)
  • Vercel BlobFile storage for uploads

AI models

  • AnthropicClaude models
  • OpenAIGPT models
  • Google GeminiImage generation and search grounding

Communications

  • TwilioSMS messaging
  • ResendTransactional email
  • VapiVoice agents and telephony
  • ElevenLabsVoice models, through Vapi
  • WhatsApp Business PlatformWhatsApp messaging (Meta)

Payments

  • StripeHosted checkout and billing portal — card data never touches our servers

Integrations

  • Meta Graph APIAds, Pages, Instagram and lead webhooks
  • Google Workspace APIsGmail, Drive, Calendar, Sheets, Docs — per-service OAuth
  • LeadConnectorCRM, calendars and conversations
  • BrowserbaseHosted browser sessions for Realtevo Computer
  • DocuSignE-signature
  • CalendlyScheduling
  • FirefliesCall transcripts
Security

How we protect your data.

Eight statements, each verifiable in our code or with the provider named.

Credentials

Encrypted before they're stored

Connector logins and agent credentials are encrypted with AES-256-GCM before they reach the database. The key lives in Vercel's environment store, not in the codebase — and if the key is missing, the vault refuses to save rather than fall back.

Google access

Only the scopes a task needs

Google access is requested one service at a time with the narrowest scope that works — Drive is drive.file only, so agents see files they created, not your whole Drive. Tokens are encrypted at rest and revoked at Google the moment you disconnect.

Payments

Processed by Stripe, never by us

Checkout and billing run on Stripe-hosted pages. Card numbers never touch our servers, and every Stripe event we act on is signature-verified first.

Inbound events

Unsigned requests are rejected

Webhooks from Stripe, Meta Lead Ads, Vapi and LeadConnector are checked against a signature or shared secret before anything runs. Internal and scheduled jobs authenticate with their own secrets.

Access control

One workspace, one boundary

Every query is scoped to your workspace; a request for another workspace's data returns not-found, never data. Admin tools are limited to an allow-list of named accounts, and everything not explicitly public requires a session.

Ads safety

Fails closed by default

Campaigns, ad sets and ads are created paused. A spend cap is written to your ad account and read back before anything can run, and a single kill switch pauses everything. You can remove our partner access from your Meta Business settings at any time.

Audit trail

Written down, every time

Agent actions that need approval, every Meta API call made on your behalf, and every credential read are recorded in audit tables you can ask us for.

Storage & transport

Encrypted at rest and in transit

Turso states all databases are encrypted at rest at the volume level and is SOC 2 audited. Every surface is TLS-only with HSTS; API responses are never cached. Our health check validates every table every six hours.

Your data is yours. Contact records, replies and appointment data generated for your business belong to you and are exportable on request. You can request deletion of your account and data at any time.

What we don't claim. Realtevo AI does not yet hold its own SOC 2 or ISO 27001 certification and has not published a third-party penetration test. Our providers hold theirs. Ask us for our security overview at hello@realtevoai.com.

Privacy Policy · Terms

For technical reviewers

The detail behind each statement.

What a reviewer would find if they read our configuration. Where a claim belongs to a provider, we say so.

Transport and headers

  • TLS on every hostname; Strict-Transport-Security: max-age=31536000; includeSubDomains on the Command Center.
  • X-Frame-Options: DENY, X-Content-Type-Options: nosniff, Referrer-Policy: strict-origin-when-cross-origin.
  • All /api/* responses carry Cache-Control: no-store.
  • Hosted on Vercel (TLS 1.2 and 1.3 — Vercel's published statement).

Database

  • Turso (libSQL/SQLite), accessed with a scoped auth token. Turso states all databases are encrypted at rest at the volume level and lists SOC 2 on its trust center (provider claims).
  • Every table is registered; a health check runs every six hours, reports existence and row counts, and recreates any missing table.
  • Schema changes are additive only — no destructive migrations.

Credentials and secrets

  • Connector logins and agent credentials: AES-256-GCM, key derived from a dedicated environment secret; the vault refuses to save if that secret is absent.
  • Google OAuth tokens: encrypted at rest, revoked at Google and deleted when you disconnect.
  • Account passwords: bcrypt hashes. Password-reset tokens are stored only as SHA-256 hashes, single-use, with expiry.
  • API keys issued to clients are stored hashed and compared in constant time; each key carries its own rate limit.
  • Runtime secrets are injected from Vercel's environment store; local env files are git-ignored.

Google OAuth scopes (exact)

  • Gmail: gmail.readonly, gmail.compose, gmail.send
  • Drive: drive.file only
  • Calendar: calendar · Sheets: spreadsheets · Docs: documents
  • Google Ads: adwords, userinfo.email, userinfo.profile
  • Requested per service you connect, never as one bundle. Google user data is used only for the feature you asked for (Limited Use — see Privacy Policy).

Inbound event verification

  • Stripe: signature and timestamp verified with the Stripe SDK before any event is processed.
  • Meta Lead Ads: X-Hub-Signature-256 HMAC-SHA256 over the raw body, constant-time compare; unsigned posts get 401.
  • Vapi (voice): per-assistant server secret, strictly enforced.
  • LeadConnector: shared webhook secret required.
  • OAuth callbacks: HMAC-signed state parameter, constant-time compare (CSRF).
  • Scheduled and internal jobs: dedicated cron/trigger secrets; each route is explicitly listed, nothing is opened by prefix.

Access control and isolation

  • Default-deny middleware: every path not on an explicit public list requires a session.
  • Admin surface restricted to an allow-list of named accounts.
  • Every dashboard query resolves your workspace first; a foreign workspace id returns 404.
  • Generated files and reports are delivered through HMAC-signed links.

Audit trail

  • Agent actions that require approval: proposal, decision and outcome recorded (agent_action_approvals, agent_action_audit); standing approvals are revocable.
  • Every Meta Graph call made on a client's behalf: tool, method, path and outcome (meta_client_audit).
  • Credential reads and writes (agent_credential_audit).
  • Also logged: email sends, voice calls, credit consumption, errors.

Ads rail — fail-closed by design

  • Campaigns, ad sets and ads are created PAUSED; a human activates.
  • Account spend cap is written first and read back; the tool refuses on mismatch.
  • One kill switch pauses every active object and confirms by read-back.
  • Access is granted by Business ID as a partner; you can remove it from your Meta Business settings at any time.

What we don't claim. Realtevo AI does not yet hold its own SOC 2 or ISO 27001 certification and has not published a third-party penetration test. We do not handle card data ourselves — payments are processed by Stripe. Our providers hold their own certifications; we cite them as theirs, not ours.

Questions or a security concern? Write to hello@realtevoai.com. See also our Privacy Policy and Terms.

Last reviewed September 9, 2026.