Security at VoiceLamp

01Sign-in without passwords

You sign in with Google or with a one-time link we email you. VoiceLamp never asks for, receives, or stores a password, so there is no password database to leak. Sign-in links work once, expire after 12 hours, and are stored only as a hash.

• Google sign-in uses the standard OpenID Connect flow with PKCE and a signed, short-lived state cookie that blocks forged sign-in attempts.
• Your session is a random token in an HttpOnly, secure cookie. We store only a one-way hash of it, and sessions end after 30 days or when you sign out.
• Suspended accounts are signed out everywhere immediately.

02Private files

• Uploads and results are stored in private cloud storage, never on public links.
• Every download is checked by the server: a file is only served to signed-in members of the workspace that owns it.
• All traffic uses HTTPS.
• You can delete any work item, and workspace owners can turn on automatic deletion after a set number of days in Settings → Retention.

03AI providers

When you approve a job, only the file or text needed for that job is sent to the provider that performs it. Provider API keys are kept on the server, encrypted with AES-256-GCM, and are never sent to your browser. The providers we use are listed in our Privacy Policy.

We do not use your content to train AI models.

04Voice permission checks

A private voice can only be created with a permission record from the voice owner. Our review team checks it before the voice is activated. If permission is withdrawn, the voice stops working for new jobs. Voice misuse can be reported at abuse@voicelamp.com.

05Payments

Card payments in USD are handled by Paddle.com, our merchant of record; rupee payments by RapidGateway. Card and wallet details go directly to them; VoiceLamp never sees or stores your card number or wallet PIN. Every payment confirmation is verified with a signed webhook, and its amount is checked, before credits are added.

06Records and monitoring

Important actions, such as price approvals, credit changes, voice approvals, and staff actions, are written to an audit log. Every job records its price before it runs, and failed jobs are refunded automatically.

07Report a vulnerability

If you believe you have found a security issue, email support@voicelamp.com with the subject "Security report". Include steps to reproduce it. Please give us reasonable time to fix the issue before sharing it publicly, and do not access other people's data or disrupt the service while testing.

We will confirm receipt within two business days.