Quick answers
Is Behavox SOC 2 Type II compliant?
Behavox says it is. A Behavox press release dated 3 April 2025 says the Type II examination, by Schellman & Company, covered security, availability, privacy and confidentiality for its SaaS platform for the period ending 31 March 2025. Its Trust Centre lists an April 2026 announcement for the period ending 31 March 2026, reporting no exceptions. Behavox says the report is available under NDA.
Does Behavox train AI on customer data?
Behavox’s security page says “Your data is never used to train or fine-tune models.” It also says frontier models run with zero data retention and that customer data does not leave the customer’s environment. The page is undated.
Where does Behavox host data?
On Google Cloud. Behavox’s security page describes an isolated cloud project per customer, customer-held encryption keys and a choice of data-residency region. It does not list the regions.
Does Behavox capture WhatsApp and WeChat?
Behavox announced WhatsApp and WeChat capture through a partnership with TeleMessage in a press release from February 2021. The Behavox product pages we read in 2026 do not mention those apps, so confirm current coverage and who performs the capture.
What Behavox states
| Area | What the vendor states | Source and date |
|---|---|---|
| Security attestation | SOC 2 Type II, examined by Schellman & Company. The 2025 release says it covered security, availability, privacy and confidentiality for the Behavox SaaS Platform, with added controls on production configuration and monitoring and on customer-data confidentiality. The Trust Centre lists an April 2026 announcement for the period ending 31 March 2026 with no exceptions. The security page says the report, with scope and period, is available under NDA. | S1, S2, S3 · 3 Apr 2025; Apr 2026 |
| AI management | Behavox says it is certified to ISO/IEC 42001:2023, the AI management system standard (November 2025), with the scope statement available under NDA. ISO/IEC 27001 is not listed among its certifications on the security page. | S1 · page undated |
| Other frameworks | GDPR, CCPA and DORA are listed as regulatory compliance. NIST SP 800-53 Rev. 5, CSA-CCM, MITRE ATT&CK and NYDFS 23 NYCRR 500 are described as mapped or self-assessed, which is different from a certification. | S1 · page undated |
| Hosting and tenancy | Google Cloud, single-tenant by default, with an isolated cloud project per customer, customer-held KMS keys and a choice of data-residency region. No regions are listed. Behavox also says it runs on Google Cloud’s FedRAMP-authorised platform, which describes the platform, not a Behavox authorisation. | S1 · page undated |
| AI and customer data | “Your data is never used to train or fine-tune models.” Frontier models are said to run in the customer’s tenant through private endpoints, with zero data retention. | S1 · page undated |
| Documents and sub-processors | The SOC 2 report, ISO certificate scope statement, penetration-test summary, standard DPA and sub-processor list are said to be available in the Trust Centre under NDA. The Trust Centre page we read shows a Subprocessors heading but no list, and its AI documents were not readable. | S1, S2 · undated |
| Products | Behavox describes a communication surveillance product (Quantum) covering voice and text in 50+ languages, and an archive described as “one compliant archive for every communication and trade”. Channels are not itemised on that page. | S4 · 2026 |
| Encrypted apps | In February 2021 Behavox announced that customers could ingest and supervise WhatsApp and WeChat messages, attachments and calls through TeleMessage, which captures the messages and delivers them to the Behavox platform. The 2026 product page we read does not mention these apps or any capture partner. | S5 · Feb 2021 |
Behavox keeps its detailed documents behind its Trust Centre, so several points below can only be confirmed by requesting them. Dates are the page’s own where it shows one; otherwise we say “undated”.
Encrypted messaging apps: check the current position
Capture of WhatsApp and WeChat is the point firms most often ask about. The only Behavox statement we found is the February 2021 release, which names TeleMessage as the capture partner. We did not find a current Behavox page that confirms the apps, the method or the partner, so treat that as a question for Behavox, not an assumption. For the wider record-keeping rules, see communications archiving tools for financial services.
Questions to ask before signing
- Request the SOC 2 Type II report under NDA and check the criteria and audit period. The 2025 release names security, availability, privacy and confidentiality.
- ISO/IEC 27001 is not listed on Behavox’s security page. If your vendor policy requires it, ask whether it is held and what the ISO/IEC 42001 certificate covers.
- Ask which data-residency regions are available, and whether a UK or EU region is offered, since the pages name none.
- If staff use WhatsApp or WeChat, ask which apps are supported today, who performs the capture, how those messages reach the archive, and what attestations the capture partner holds.
- Ask how retention is set and how records are kept unaltered. The pages we read give no retention periods or WORM wording.
- Get the “never used to train or fine-tune models” statement into the contract, and ask for the AI Security and AI Training Data documents listed in the Trust Centre.
- Ask for the sub-processor list before signing, and how changes are notified.
Who it fits
Behavox suits firms that want AI-led surveillance and an archive from one vendor, with single-tenant hosting and a choice of region. Because encrypted-app capture was announced as a partner service in 2021 and is not described on the current pages we read, firms whose staff use WhatsApp or WeChat should test that first. Pricing was not in the pages we reviewed.
Sources
- S1: Behavox: Security and compliance, undated.
- S2: Behavox Trust Centre, undated, lists an April 2026 SOC 2 announcement.
- S3: Business Wire: Behavox completes SOC 2 Type II examination, 3 April 2025.
- S4: Behavox product overview, undated, 2026 copyright.
- S5: Business Wire: Behavox integrates WhatsApp and WeChat data with TeleMessage, February 2021, date taken from the release address.
All sources read on 15 October 2026. Where a page shows no date, we say so. The Trust Centre’s own documents and the SOC 2 report were not available to us.
Visit Behavox
Check the vendor’s current pages, then compare it with the other communications archiving tools in the directory.
Go to BehavoxCompare all communications archiving tools · Global Relay review · Webex and SEC archiving guide