Security at Ox

Ox takes security seriously with constant monitoring and best practices across the stack. Our engineers work tirelessly to ensure that all of Ox's code and infrastructure is secure.

Customer Data & Encryption

We take the security of your data and audio recordings seriously with the below best practices:
  • Audio is only recorded when initiated by the end-user and is kept private to that user until purposefully shared
  • All audio recordings and data are encrypted at rest and transit with bank-level security, AES256 bit encryption
  • Minimum TLS 1.2 is used everywhere in the Ox ecosystem to secure network communication
  • Strict access controls


Hosted within Google Cloud and AWS, and secured at the edge with Cloudflare, Ox benefits from the comprehensive security controls in place to secure our servers physically and virtually.

For more information on the security practices of our cloud providers, please visit the links below.

Threat Detection and Management

  • Integration with Google Cloud Platform Cloud Armor, Cloud Anomaly Detection, and monitoring services
  • Integration with Google Cloud Platform Data Loss Prevention
  • Integration with Cloudflare Web App Firewall (strict)
  • Fleetwide audit logging

Security Monitoring & Quality Controls

  • Peer code reviews: every pull request is reviewed by peers, whether it’s a new feature or bug fix. Security reviews are performed as appropriate for the work
  • Regular code audits for security
  • Continuous integration and delivery: we use GitHub, GCP, and AWS for our CI tooling. Every PR that is merged is automatically subjected to a pipeline of rigorous tests and analysis as appropriate for the code that is being merged
  • Robust unit testing
  • Ox maintains a comprehensive log of app interactions used internally for troubleshooting and support. These can be available upon reasonable request


We leverage the latest, greatest technologies to continually deliver the Ox experience with minimal downtime. Part of our platform does rely on new serverless technology that spins down opportunistically, then spins up upon being used, though it is always ready to serve.