# Security and Data Protection > How Avox protects your account, your customers' phone numbers, and your data - and the security settings you control. Source: https://docs.theavoxai.com/security Your customers trust you with their phone numbers and conversations, and you trust Avox with the same data. This page explains how that's protected, and the security settings you control yourself in **Settings > Security**. > **Success** > > Avox is a verified Meta Business Partner. Every WhatsApp connection runs through Meta's official > WhatsApp Business Platform. ## Settings > Security | Card | What it does | Guide | | --- | --- | --- | | **Overview tiles** | Two-factor on or off, how many passkeys, how many signed-in devices. Click one to jump to its card. | - | | **Password** | Change your password. | [Your password](#your-password) | | **Passkeys** | Sign in with Face ID, Touch ID, Windows Hello, or a security key. | [Passkeys](https://docs.theavoxai.com/security/passkeys) | | **Two-factor authentication** | Require a 6-digit authenticator code at sign-in. | [Two-factor](https://docs.theavoxai.com/security/two-factor) | | **Active devices** | See where you're signed in and sign out everywhere else. | [Sessions](https://docs.theavoxai.com/security/sessions) | | **Recent security events** | Your own recent security changes. | [Recent security events](#recent-security-events) | | **Delete account** | Opens the Delete account page: pause your account instead, or delete it. | [Deleting your account](#deleting-your-account) | Everything on this tab is about your own account, so every member can use it, whatever their role. ## Your password Changing your password takes three steps on the **Password** card. The heading above the fields tells you which step you're on, and the main button is always at the bottom right. **1. Confirm your current password** Type it and click **Continue** (or press Enter). Avox checks it on its server; if it's wrong you see "That's not your current password". Use the eye button to show or hide what you typed. **2. Choose a new password** Type your own: a strength bar and a checklist show the rules as you go (8 to 72 characters, an uppercase letter, a lowercase letter, a number, no space at the start or end, and different from your current password). Or click **Generate a strong password** for a random 20-character password with no look-alike letters, then copy it into your password manager. Type it again in **Type it again** (a generated password fills this in for you), then click **Review**. **3. Confirm and save** Check the summary and click **Update password**. **Back** takes you to the previous step. You see "Your password is updated", you get a **Password changed** email, and **every other device is signed out** - they sign in again with the new password. The device you're on stays signed in. If a password is too common to be safe, you see "That password can't be used - pick a stronger, less common one". An account that only signs in with Google or Facebook has no password to change ("This account signs in with Google or Facebook and has no password to change"). If the change fails for another reason you see [AVX-3087](https://docs.theavoxai.com/error-codes/avx-3087). Repeated attempts are slowed down ("Too many attempts - wait a few minutes and try again"). Can't remember your password? Reset it from the sign-in page - see [Forgot your password](#forgot-your-password) below. ## Forgot your password Click **Forgot password?** under the password field on the sign-in page. It gets easier to spot after a wrong password, or once you've been on the page for a minute. Everything happens inside the sign-in card: **1. Enter your email** It's filled in from the sign-in form. Click **Email me a code**. **2. Enter the 6-digit code** Check your inbox (and spam) for the **Password reset code** email and type the code into the six boxes - it's checked as soon as the last digit is in. You see the same message whether or not the address has an account, so nobody can use this form to find out who uses Avox. Typed the wrong address? Click **Wrong email?**. No email after a minute? Click **Send a new code** (you can ask once a minute). **3. Confirm it's you (two-factor accounts only)** If you've turned on [two-factor authentication](https://docs.theavoxai.com/security/two-factor), enter the code from your authenticator app before you can choose a new password. **4. Choose a new password** Type your own - a checklist shows the rules as you go (8 to 72 characters, an uppercase letter, a lowercase letter, a number, no space at the start or end), with a strength bar - or click **Generate a strong password** and copy it into your password manager. Click **Save new password**. You're taken back to the sign-in form with your email filled in and "Password updated", and you sign in with the new password. Every other device is signed out, and you get a **Password changed** email. The email also has a **Choose a new password** link. It does the same as the code, but only in the browser where you clicked **Forgot password?** - on another device, use the code. - "That code has expired or was already used" - click **Send a new code** and use the newest one. - "That's the password you already have" - pick a different one. - "Too many tries" - wait a few minutes, then try again. If you can't get the email at all, sign in another way you've set up (a passkey, Google, or Facebook), or email hello@theavoxai.com from your account's email address and the Avox team will help you back in. ## Recent security events The **Recent security events** card lists your own latest security changes, newest first: password changes, two-factor turned on or off, Switchboards you paused, resumed, deleted, or left, and role or permission changes you made. Only you see your own list. If something there wasn't you, change your password, sign out your other devices, and contact support. ## How your account is protected - **Strong sign-in options.** Email and password, Google, Facebook, and passkeys - and you can add [two-factor authentication](https://docs.theavoxai.com/security/two-factor) on top. With two-factor on, your account stays closed until the second step is done - the dashboard, the data, everything. - **Alerts for important changes.** You get an email whenever your password, email address, two-factor setting, or connected sign-in accounts change, and when your account is opened on a new device. Each one has a link to reset your password if it wasn't you. See [Emails](https://docs.theavoxai.com/emails#security-notices). - **Confirmation for risky actions.** Changing your email needs approval from both your old and new inbox. Deleting your account needs your current password or a 6-digit code emailed to you, the word DELETE typed in, and a press-and-hold to confirm. Deleting a WhatsApp connection needs a one-time code emailed to the Switchboard's Owner. Deleting a Switchboard needs its exact name typed in, a one-time code emailed to you, and a press-and-hold to confirm. Pausing a Switchboard, and creating, rotating or revoking an API key, need an emailed code too - see [Emailed codes for sensitive actions](#emailed-codes-for-sensitive-actions). - **Sessions that end.** Sign-ins expire and refresh automatically, so an old browser tab or a lost laptop isn't a permanently open door. You can sign out every other device at any time from [Active devices](https://docs.theavoxai.com/security/sessions). - **Suspended accounts are paused everywhere at once.** If the Avox team suspends an account, it can't be used anywhere until the suspension is lifted. Changes such as a new password show "This account is suspended. Contact Avox support." ## Emailed codes for sensitive actions A few actions change something important for the whole Switchboard, so Avox asks the person doing them to confirm with a 6-digit code sent to their own sign-in email address: - creating, rotating or revoking an [API key](https://docs.theavoxai.com/connections/api-keys#confirmation-codes); - [pausing a Switchboard](https://docs.theavoxai.com/switchboard#pausing-a-switchboard); - [deleting a Switchboard](https://docs.theavoxai.com/switchboard#deleting-a-switchboard). Each code: - works **once**, for **10 minutes**; - works only for you, in that Switchboard, for that one action on that one key or Switchboard - a code sent to revoke one key can't revoke another; - is replaced when you ask for a new one (the earlier code stops working); - stops working after **5 wrong tries** - ask for a new code then. So even someone using a signed-in browser of yours can't make these changes without also reading your inbox. Deleting a WhatsApp connection uses a code too, sent to the Switchboard's Owner - see [Delete](https://docs.theavoxai.com/connections#delete). ## Your data is kept separate from every other business Avox is a shared platform, but every piece of your data - connections, contacts, conversations, templates, logs - belongs to your Switchboard, and only that Switchboard's members can see it. Inside your Switchboard, [roles and permissions](https://docs.theavoxai.com/switchboard/members) decide who can see and change what. Managers do the day-to-day work by default, while connections, API keys, the team, Switchboard settings and billing start out Admin-only. An Admin can give a Manager individual permissions, or take some away, person by person, and Avox checks every permission on its servers, not only in the dashboard. See [Permissions](https://docs.theavoxai.com/switchboard/members#permissions). ## Phone numbers are encrypted Your customers' phone numbers are stored encrypted, not as plain text. ## Incoming events are verified - Every event from Meta about your WhatsApp numbers is checked against Meta's signature before Avox acts on it. Anything that merely *claims* to be Meta is refused. - Payment updates are confirmed with PayPal before your plan changes. - Data-deletion requests from Meta are checked the same way. See [Data deletion](https://docs.theavoxai.com/data-deletion). ## API keys Outbound API keys are shown in full only once, when created. Each key has a name, an optional description and a record of who created it, sends from one connection only, can be limited to a list of IP addresses, and can be revoked instantly. Creating, rotating and revoking a key need an [emailed code](#emailed-codes-for-sensitive-actions), and rotating keeps the key's limits, so it's never a way around them. Admins are emailed when a key is created or revoked, used from a new IP address, or blocked by its IP list. See [API keys](https://docs.theavoxai.com/connections/api-keys) and [Authentication](https://docs.theavoxai.com/avox-api/authentication). ## Limits on repeated attempts Repeated guessing or flooding is slowed down and refused. If you see a "too many attempts" or "too many requests" message, wait a minute or two and try again. ## Avox staff access Avox staff work in a separate internal dashboard with its own extra sign-in step. Staff actions on customer accounts are recorded, and you're emailed when the Avox team changes something on your account ("Account updated by Avox"). ## Privacy choices - **Cookies.** avox.com, the docs, and the status page ask before setting anything beyond essential cookies. See [Cookie choices](https://docs.theavoxai.com/compliance#cookie-choices). - **Agreements.** **Settings > Profile > Agreements** lists every policy you've agreed to. See [Profile](https://docs.theavoxai.com/settings/profile#agreements). ## Deleting your account Open **Settings > Security** and click the **Delete account** card's button. The Delete account page walks you through four short steps, and **Continue deleting** is on every one of them: **1. Tell us why you're leaving** Pick a reason (and add a few words if you like). It helps us improve. Prefer to skip it? Click **Go straight to deleting**. **2. See your options** Depending on your reason, you may see an offer, a way to send us feedback, or a quick way to open a support ticket. You never have to take any of them. You also see what's in your account, and **Pause your account instead**. **3. Confirm** The page shows exactly what will happen to your account and your Switchboards. Confirm it's you with your password or a 6-digit code we email you, type **DELETE**, then press and hold the button. **4. Done** You see a short goodbye, and we email you a confirmation. What happens depends on your Switchboards: - **Every Switchboard you're an Admin of has another Admin** (or you're only a Manager): your login and profile are deleted straight away and you're signed out. Those Switchboards carry on without you. - **You're the only member of a Switchboard**: that Switchboard is deleted together with your account, with everything in it. The Avox team carries this out within 30 days, usually much sooner, and emails you when it's done. Until then your account works as normal, and you can cancel the request from [Compliance](https://docs.theavoxai.com/compliance). - **You're the only Admin of a Switchboard other people use**: make someone else an Admin (or remove the other members) first. If your plan is billed through a Switchboard that would be deleted, cancel the plan on **Billing** first so PayPal stops charging you. The page tells you which applies. Payment and invoice records we're required to keep by law are kept separately from your login. ### Pausing instead **Pause my account** pauses every Switchboard you're an Admin of: its WhatsApp numbers and its automations stop, and nothing is deleted. If you pay monthly through PayPal, billing is paused too, so you aren't charged while paused. A plan paid upfront keeps its end date. Come back to the Delete account page and click **Resume my account** to switch everything back on. If your plan's number limit is reached, any numbers that don't fit stay paused and you can resume them from [Connections](https://docs.theavoxai.com/connections). ### If you accepted an offer An offer you accept is set aside for your account only and we email you the details. A discount code works once, while you're signed in to this account, until the date shown - **Apply to my plan** takes you to checkout with the code filled in. If you already pay through PayPal, the code can't be added to that plan; cancel its renewal on **Billing** and check out again with the code, and the discounted plan replaces the old one straight away. A plan gift has an **Accept your gift** link. Bonus automation credits are added to your account immediately. ## Data deletion You can delete a Switchboard, your account, or your Facebook-linked data, and track a request from Meta on a public status page. See [Data deletion](https://docs.theavoxai.com/data-deletion) and [Compliance](https://docs.theavoxai.com/compliance). ## Reporting a security problem If you spot something that looks wrong - a sign-in you don't recognise, an email you didn't expect - change your password, sign out your other devices, and email hello@theavoxai.com or open a ticket in [Support](https://docs.theavoxai.com/support).