Where your data lives
SeloraX runs on established cloud providers: DigitalOcean, Vercel, Cloudflare and MongoDB Atlas. Our servers are mainly in India, Singapore and the United States.
Phone calls are the exception. They enter through our own SIP gateway in Dhaka, connected to a licensed Bangladeshi carrier, before they reach the AI agent.
How we protect accounts
- Passwords are stored only as scrypt or bcrypt hashes, never in plain text.
- Sign-in codes sent by SMS are stored hashed and expire after 10 minutes.
- Login, sign-up and password-reset attempts are rate limited to stop guessing attacks.
- Sign-in sessions are cryptographically signed, so they can't be forged.
- Resetting a password signs out existing sessions.
- API keys are shown to you once and stored only as a hash.
Encryption
- Our websites, dashboards and APIs are served over HTTPS.
- Credentials for the tools you connect (calendars, CRMs, payment gateways) are encrypted with AES-256 before they are saved.
- Webhooks we send are signed with HMAC-SHA256, so your systems can check a message really came from SeloraX.
Keeping each business separate
Every business on SeloraX is its own account. Each request is checked against the account it belongs to before any data is read or changed.
Changes to an AI agent's settings are written to an audit log that records what changed and who changed it, without copying the values themselves.
Phone calls, recordings and AI
- Calls are recorded by default so you can review what your agent said. You can turn recording off for any agent.
- Transcripts and call details are saved to your account so you can search and review them.
- To understand and answer a caller, we send the audio and text of the conversation to the AI providers listed below. They receive only what the call needs.
- We do not use your recordings or conversations to train AI models unless you opt in. That setting is off by default.
Keeping and deleting data
We keep your business data, call logs and recordings while your account is active, so your history stays available to you.
You can ask us to delete any of it, or your whole account, at any time by emailing [email protected] from the email or phone number on the account. We confirm when it is done.
Service providers we use
These companies process data for us so SeloraX can work. We share only what each one needs.
| Provider | What it does for us |
|---|---|
| DigitalOcean, Vercel, Cloudflare, MongoDB Atlas | Hosting, databases and file storage |
| OpenAI, Google (Gemini), xAI, ElevenLabs | Speech recognition, AI replies and agent voices |
| Licensed Bangladeshi telecom carrier | Connecting phone calls |
| Meta (WhatsApp, Messenger, Instagram) | Delivering XChat conversations |
| SeloraX SMS, BulkSMS BD, Firebase | SMS codes, alerts and app notifications |
| SSLCommerz, EPS, Stripe | Processing payments |
| Steadfast and other couriers | Booking deliveries for SeloraX Commerce stores |
| PostHog, Google Analytics, Meta and TikTok pixels | Measuring visits and ads on our website |
Report a security issue
Found a vulnerability? Email [email protected] with "Security" in the subject line and the steps to reproduce it. We will reply, keep you updated while we fix it, and won't take action against good-faith research.
Please don't access other people's data, disrupt the service or share the issue publicly before it is fixed.
Security reviews and contracts
Working with a bank, insurer, hospital or other regulated business? We can complete your security questionnaire and agree data-processing terms with you. Email [email protected].
How we handle personal data is set out in our privacy policy at selorax.io/privacy.