Security

Ephemeral audio processing

Raw audio is never written to disk, never placed in a persistent queue, and never uploaded to object storage. It exists in process memory for the duration of one utterance.

This is enforced in code, not just in policy: our test suite fails the build if the real-time code path gains file-system or object-storage access.

Encryption

In transit: TLS 1.2+ for HTTP, WSS for audio streaming.

At rest: disk-level encryption for databases; stored transcripts inherit it.

Authentication

• Passwords hashed with argon2id.
• Short-lived access tokens (15 minutes) plus rotating refresh tokens; reuse of a revoked refresh token revokes the whole session chain.
• WebSocket connections authenticate with a single-use token valid for 5 minutes — the main token never appears in a URL.
• Optional TOTP two-factor authentication.
• Device session list with individual revocation.

Logging discipline

We never log the content of speech or translations. Redaction is implemented in the logging pipeline itself, so it applies regardless of which developer writes the log line.

Internal access to customer data is recorded in an audit log.

Tenant isolation

Provider configuration is resolved per tenant at runtime. Enterprise customers can be moved to the local processing tier — where nothing is sent to third-party AI providers — as a configuration change, with no code deployment.

What we have NOT done yet

We are not SOC 2 or ISO 27001 certified. We are stating that plainly rather than implying otherwise. A SOC 2 Type I audit is planned; we will publish the report and update this page when it is complete.

We do not currently run a public bug bounty. Report vulnerabilities to [email protected]; we aim to acknowledge within 2 business days.