Security & privacy
What happens to the things you upload
Recordings of customer calls and unsigned contracts are among the most sensitive material a company has. Here is the handling, stated plainly enough to forward to your own security team.
Encryption
TLS 1.3 in transit, AES-256 at rest, on every plan including the free one. Media and documents sit in separate buckets with distinct access policies.
No training on your data
Your prompts, uploads and documents are never used to train our models or a provider's. We use zero-retention endpoints wherever a provider offers them.
Access control
Workspace, folder and document-level permissions. SSO and an audit log are available on Scale. Sessions are revocable per device.
Deletion timelines
Deleting content removes it from live systems immediately and from backups within 90 days. Closing an account removes everything within 30 days.
Data residency
Processing is in the EU and UK by default. Scale plans can pin storage to a specific region.
Subprocessors
The current list of model and infrastructure providers is published and updated before any change takes effect, not after.
Responsible disclosure
Email security@voicetapp.com with enough detail to reproduce the issue. We acknowledge within one business day and aim to have a fix or a timeline within five.
We will not pursue legal action against good-faith research that stays within these lines: no access to other people's data beyond what is needed to prove the issue, no degradation of service, no social engineering of staff or users, and no public disclosure before a fix ships.
What we do not claim
We are not SOC 2 or ISO 27001 certified today. Saying so is more useful to you than implying it with a badge. If your procurement process requires certification, tell us — knowing the demand is what moves it up the roadmap.
Compliance status
- UK GDPR / EU GDPR
- Compliant. DPA available on request.
- Data processing agreement
- Signed on request, for any paid plan.
- Subprocessor list
- Published, updated before changes take effect.
- SOC 2 Type II
- Not certified.
- ISO 27001
- Not certified.
- HIPAA
- Not supported. Do not upload PHI.