Architecture, data residency, and the security controls we adopt to protect your content, cloned voices, and payment data.
HTTPS/TLS in transit
Encryption at rest, depending on the infrastructure provider
Managed cloud infrastructure
Security audit logs
Data residency and infrastructure
Database Supabase Postgres, according to the project's configuration and the provider's technical and organizational measures.
CDN Cloudflare. Traffic is served over HTTPS; any network protections depend on the service configuration.
Backend API Railway, according to the service configuration.
Object storage (R2) Cloudflare R2, according to the service configuration and the provider's security measures.
Payments Stripe — PCI-DSS Level 1. No card number passes through or is stored on our systems.
Identity and authentication
Passwords hashed with bcrypt (cost 12).
6-digit OTP by email for signup and password reset.
Session token with httpOnly + Secure + SameSite=None (required for cross-origin use between the app and API).
Sign in with Google; an SSO SAML 2.0 configuration is available for the Enterprise tier.
Biometric data protection (voice)
The raw voice sample is personal data. The processed voice features and the derived voice model are also personal data and may constitute biometric data under Art. 9 GDPR when they result from specific technical processing aimed at uniquely identifying a person (voice identification/authentication). The voice cloning/synthesis we offer is not intended to uniquely identify you, but we nonetheless apply, as a precaution, the same safeguards provided for biometric data — see Biometric Data Policy.
Electronic consent recorded (text, version, IP, date and time).
Cross-language gate — synthesis is blocked in any language not explicitly authorized by the user at the time of enrollment. Unauthorized attempts generate a safety_event of type consent_violation.
Early destruction when the purpose no longer applies, upon withdrawal of consent, or upon deletion of the profile; current internal maximum limit of 1095 days from consent (see Biometric Data Policy). Withdrawal and deletion on request.
Security audit logs
Selected security events (e.g. access events, account management, SSO access, and administrative actions) are recorded in the table audit_events with IP, user-agent, and UTC timestamp.
CSV export is available from the administrator dashboard (admin role).
The export itself is audited (action admin.audit_exported).
Monitoring and incident response
Application and infrastructure logs are managed through the hosting providers' services.
Signed Stripe webhooks (HMAC SHA-256) — unsigned payloads are rejected.
In the event of a personal data breach that poses a risk to individuals' rights and freedoms, the supervisory authority is notified without undue delay and, where feasible, within 72 hours of becoming aware of the breach; affected individuals are informed in the cases required (GDPR Arts. 33-34).