Security and privacy
Data is separated per company, permissions start with the role and end with the person. Access to personal data is opened by permission, and critical actions are logged.
Data and permissions
Companies can't see each other; users only see what they're allowed to
Separation starts in the database and carries on into menus, tables and server responses.
A separate database per company
Each company's users, roles and module data live in its own database; companies can't see each other's data.
Central management
Opening companies, enabling modules and connecting a PBX are reserved for the central administrator (Super Admin); a company administrator can't change them.
Role and per-user permissions
Permissions start with the role: a permission missing from the role can be granted to a person, one in the role can be removed; privilege escalation is blocked.
Column visibility
Table columns are hidden by role. A hidden column never appears in server responses and can't be used for filtering.
Permissions turned off centrally
The center can turn off a permission for a company; once off, it can't be given to any role in that company.
Deactivated companies
When a company is deactivated, its users can't log in and open sessions are ended.
Identity and sessions
Two-factor authentication, session control and an audit log
Even if a password leaks, a second step is required; users stay in control of their own sessions, and critical actions are logged.
Two-factor authentication
TOTP, QR code and backup codes. Optional; if a phone is lost, the central administrator resets it.
Session management
Active devices are listed; sign out a single device or every other device. Role and permission data refreshes every minute.
View as user, logged
An authorized manager can review a user's screen with that user's permissions; start and end are recorded and the reviewer's name stays in the session log.
Audit log
Logins and failed login attempts, user, role and permission changes, settings changes, entering a company and exports are logged; secret fields such as passwords and keys are masked. A company administrator only sees their own company's log.
Bot protection on forms
The contact and sign-up forms are protected by reCAPTCHA, a hidden honeypot field and a per-IP rate limit.
Clean profile photos
An uploaded profile photo is re-encoded on the server and metadata such as location is removed. The widget logo is also checked by its content and re-processed.
Personal data
Tools for your data protection processes
Access to personal data is opened by permission, data that isn't sent can't leak, and access is logged.
Number masking
For masked roles the phone number is removed from server responses. A masked agent can't dial by typing a number; calls are placed from the record.
Call recording access log
Listening to a recording needs its own permission and every access is logged. When the retention period ends the file is deleted and the call record stays.
Chat traffic stays with you
Live chat's real-time connection runs on your own server; unless you turn on Claude AI, chat traffic never leaves for a third party.
Attachments aren't public
Chat attachments open through signed, expiring links; SVG and HTML files aren't accepted.
Transcripts only to their owner
A chat transcript email only goes to the visitor's own address; agents can't type a different one.
Encrypted connection details
PBX credentials and webhook keys are stored encrypted and never returned in responses. Webhook requests can't be sent to internal network addresses.
Data sent to AI is masked
The free VOLTR matcher never takes conversations off the server. If you turn on Claude AI, card numbers, Turkish ID numbers and IBANs are masked before conversations go to Anthropic.
Contact blocking
Unwanted contacts can be blocked on WhatsApp and Telegram: their messages aren't stored and they can't be messaged. On WhatsApp, a contact who wrote in the last 24 hours is also blocked on Meta's side.
Cookie consent
On our website, analytics and advertising scripts only load with your cookie consent; without it none of them run, and you can change your choice later.
Operations
Errors are visible, updates don't interrupt
The system is monitored continuously; every update starts with a backup and never goes live untested.
Error monitoring
Errors on the server and on screen are logged and similar ones are grouped: how often, first and last seen, in which company. If a panel crashes, the rest of the page keeps working.
Alerts
The central administrator is alerted when errors or failed logins rise unusually and when the disk is close to full.
System status
The live version, queued and failed jobs, disk and database sizes on one screen.
Zero-downtime updates
A new version is tested before it goes live; the switch is instant, and if something goes wrong the previous version comes back.
Backup before every update
Before every update the central and all company databases are backed up, and each backup is verified to open.
On your own server
On the Enterprise plan VOLTR is installed on your own server; databases and files stay in your infrastructure.
FAQ
Security questions
Is our data in the same database as other companies?
No. Every company has its own database where its users, roles and module data live. Companies can't see each other's data.
How does VOLTR help with our data protection processes (e.g. GDPR, KVKK)?
Access to personal data is opened by permission: phone numbers are removed from responses by role, listening to call recordings needs its own permission and every access is logged, and recording files are deleted when their retention period ends. Compliance itself depends on your company's processes.
Is two-factor authentication mandatory?
No, users turn it on from their own profile. If a phone is lost, they log in with backup codes or the central administrator resets it.
Can a manager see a user's screen?
An authorized manager can use "view as user" to review a user's screen with that user's permissions. Start and end are recorded and the reviewer's name stays in the session log.
Can we see who did what?
Yes. The audit log keeps logins, failed login attempts, user, role and permission changes, settings changes and exports; secret fields are masked. A company administrator sees their own company's log.
Does the system go down during updates?
No. A new version is tested before it goes live and the switch is instant; if something goes wrong the previous version comes back. Before every update all databases are backed up and the backups are verified.
Can we run VOLTR on our own server?
Yes, on the Enterprise plan. VOLTR is installed on your own server; databases and files stay in your infrastructure. Unless you turn on Claude AI, chat traffic never leaves for a third party.