What was said is locked before it is stored
Call transcripts and recordings are encrypted before they are written anywhere, with AES-256-GCM and a separate key for each account. Those keys are themselves locked by a dedicated key-management service in India, kept apart from our database, and the master key that locks them is rotated automatically. Your key is never stored in a form anyone can read.
- A copy of our database, on its own, does not reveal what was said.
- Deleting your account destroys your key. A transcript or recording of yours that survives anywhere, a backup included, can no longer be read.
- Calls stored before 17 October 2026, when this started, were encrypted the same way after the fact.
Why AES-256
AES-256 is the encryption standard trusted with the world's most sensitive data:
- The U.S. government approves AES-256 for information classified TOP SECRET.
- WhatsApp encrypts every message with AES-256 keys.
- Google and Amazon encrypt the data stored in their clouds with AES-256.
- AES-GCM, the exact form we use, is what protects HTTPS: the padlock in your browser when you bank online.
Every connection is encrypted
- The app talks to our servers only over encrypted connections (HTTPS), and so do our servers when they reach the services that help run sunva.ai.
- Every request for your information must carry your verified sign-in: your phone number, confirmed with a one-time code.
- Every message from our call provider must carry its signature. A message without one, or whose signature does not match, is refused.
Everything else is protected too
Your call summaries, contacts, settings and your chat with the assistant are also stored encrypted and kept behind strict access controls. Notifications travel to your phone encrypted. We keep strengthening these protections as sunva.ai grows.
Our keys and passwords
- The passwords our servers use are kept in a dedicated secrets vault, never in our code. Our code is private.
- Our servers run under their own restricted identity, allowed to do only what they need, and hold no key files.
- The keys that lock your call data are held by a separate service from the database they protect.
We keep less, so there is less to lose
- Call recordings are deleted after 30 days.
- Technical call logs are deleted after 7 days, and our server logs never contain the words of a call, only numbers and timings.
- The app has no analytics, crash reporting or advertising code, and this website collects nothing.
In India
Our servers, and the keys that lock your call data, are in India.
Who can get in
Access to our systems is limited to the people who operate them. Reading a transcript or a recording needs both our database and the separate key service.
If something goes wrong
No service can promise perfect security, and we will not pretend otherwise. If a breach affects you, we will tell you and the Data Protection Board of India, as the law requires.
Found a security problem?
Write to zenlead.info@gmail.com with "Security" in the subject. Tell us what you found and how to see it, and please do not open, change or keep anyone else's information while looking. We will reply, and fix what is real.
This page describes what the software does today. It is not a guarantee or legal advice.