Security Architecture & Controls
A comprehensive overview of implemented security practices, transport encryption, authentication models, and data protection measures powering Voocaly.
Transport Layer & HTTP Hardening
Production web traffic is encrypted in transit using modern Transport Layer Security (TLS 1.2 and TLS 1.3) as managed at the hosting and proxy tier. The application enforces HTTP Strict Transport Security (HSTS) with the preload directive in its HTTP response headers to instruct browsers to connect exclusively via HTTPS.
- Content Security Policy (CSP): Restricts executable script sources to verified origins.
- Clickjacking Defense: X-Frame-Options: DENY blocks unauthorized iframe embedding.
- MIME Sniffing Prevention: X-Content-Type-Options: nosniff mandates strict content typing.
- Referrer Policy: origin-when-cross-origin protects user path privacy across external links.
Authentication & Identity Management
User authentication is managed via Firebase Authentication using industry-standard protocols and cryptographically signed JWT tokens. User passwords are never stored in plaintext on Voocaly servers.
Protected API endpoints verify Bearer tokens on every incoming request, validating user identity, active subscription entitlement, and monthly character allowances server-side before queueing synthesis jobs.
Payment Security & Merchant of Record
Payment-card processing is handled by Paddle within its secure payment infrastructure. Voocaly does not directly collect, process, or store raw payment-card numbers or CVV codes.
Checkout interactions utilize client-side tokenization and verified server-side transaction IDs with HMAC webhook signature validation.
Rate Limiting & Infrastructure Resilience
To protect backend synthesis resources from denial-of-service (DoS) and brute-force abuse, Voocaly enforces:
- Token bucket rate limiters across text-to-speech synthesis and AI chat routes enforced via in-memory sliding window buffers.
- Payload size validation to prevent memory exhaustion from oversized request bodies.
- Idempotency keys on billing transactions to prevent accidental duplicate charges.
Responsible Disclosure
If you identify a potential security issue in Voocaly services, we welcome responsible disclosure reports. Please provide detailed steps to reproduce the finding and avoid accessing or disrupting other users' accounts or data.
Direct disclosure reports to: support@voocaly.com
Security & Data Privacy FAQs
Detailed answers to common questions regarding AI training boundaries, storage retention, guest data, and account erasure.
Does Voocaly use submitted text scripts or audio recordings to train AI models?
Voocaly does not use Customer Inputs (scripts, text prompts, reference audio) or Generated Outputs to train, fine-tune, or improve Voocaly's own foundation, acoustic, or speech models. Upstream third-party neural inference providers process data solely to execute requested speech synthesis operations, governed by applicable commercial provider terms.
Where is guest session audio stored, and is it uploaded to cloud databases?
Unauthenticated guest demo generations are stored entirely in the visitor's browser via IndexedDB and localStorage. Guest audio files and script drafts are never written to cloud account databases or persistent server storage.
How is generated audio retained and can I delete it?
Generated audio is delivered directly to your browser as an in-memory stream and saved to your workspace History. Users can permanently delete any individual generation from their History at any time directly from the studio interface.
How does self-service account deletion work?
Self-service account deletion permanently removes active user accounts, generation records, custom voice models, and reference audio from Voocaly systems (/api/account/delete), subject to limited records lawfully retained for security, fraud prevention, or statutory compliance. Statutory financial transaction records are preserved independently by Paddle as Merchant of Record.
How is payment security handled?
Voocaly does not directly collect or store payment card numbers. Payment-card processing is handled by Paddle within its payment infrastructure. Voocaly receives only customer identifiers and transaction status tokens.