Skip to main content

​
Data Protection and Privacy

​
Encryption

Avoca uses encrypted connections for customer and integration traffic and relies on managed infrastructure encryption for supported data stores and backups. Cryptographic keys and service credentials are restricted to the systems and personnel that require them. Custom integrations must use HTTPS with TLS 1.2 or later. Do not transmit credentials, payment information, or other sensitive values in URL parameters or logs.

​
Tenant Isolation

Avoca uses authenticated, team-scoped access patterns and authorization controls to separate customer data. API credentials and webhook secrets must be scoped and stored according to the applicable integration documentation.

​
Data Minimization

Collect and exchange only the data needed for the configured workflow. Avoid placing unnecessary personal data in free-text fields, logs, error messages, or support requests.

​
Privacy Requests

Requests to access, correct, export, or delete personal data are handled according to the applicable customer agreement, product behavior, and legal requirements. Do not assume that an undocumented API endpoint performs a complete privacy deletion. Contact Avoca Support for a privacy request or for help identifying the systems involved in a particular data flow. Retention varies by product, data type, integration, and contractual requirement. Customers with a specific retention or legal-hold requirement should confirm it during implementation. Messaging and marketing workflows must respect the customer’s current consent and opt-out state. See How messaging registration and opt-outs work for customer-facing guidance.
Avoca’s controls support customer compliance efforts, but each customer remains responsible for determining the laws and consent requirements that apply to its use of the service.