Trust & Security
The product runs on customer trust. This page lays out how data is stored, who can reach it, how long we keep it, and how to find the things we haven't shipped yet.
Data handling
Six things you can hold us to, and that we document for procurement reviewers.
TLS in
msEncrypt at rest
AES-256Isolated storage
per-accountRetention window
configDeletion
on requestEncryption everywhere
TLS in transit. AES-256 at rest. Object storage isolation so one customer's audio can't be reached by another.
Your audio stays yours
We don't pool customer audio into a generic training set without explicit opt-in. Your uploads belong to your account.
Configurable retention
Default retention windows are documented in the privacy policy. Paid plans can shorten them; enterprise can extend or isolate.
Delete on demand
Delete a voice, a project, or your whole account from the dashboard. Backups roll off within the documented retention window.
Role-based access
Team accounts get role-based permissions across projects and the API. SSO, SAML, and OIDC available on Enterprise.
Regional handling
Primary processing happens in regions chosen for latency and compliance. Dedicated regions available for committed-use accounts.
Compliance posture
We don't claim certifications we don't have. Here's the split.
Responsible disclosure
Safe harbor for good-faith research
Test against your own account. Don't access other customers' data. Don't run destructive payloads. Give us a reasonable window to fix before public disclosure. We acknowledge every report within two business days and credit confirmed reporters in our hall of fame.
Ack
Within 2 business days
Triage
Within 5 business days
Fix window
90 days, negotiable
Documents we share
The standard pack. Custom requirements are common — talk to us.
Common questions
Send your security questionnaire to the trust team. Most reviews close in two to four weeks.