Voca is built so the audio you speak never lives long enough to be a liability. This page explains the architecture, the controls, and the third parties involved — in enough detail that a security team can sign off, and in plain enough English that you don't need one to understand it.
When you press the hotkey and start dictating, your audio takes a short, one-way trip. It is captured on your device, streamed over TLS to our API, forwarded to the transcription provider, and discarded the moment the transcript text returns. Nothing is written to disk on our side. Nothing is queued. Nothing is backed up.
The single sentence version: your audio is in our possession for the seconds it takes to transcribe it, in memory, and then it is gone.
All traffic between the client, our API, and Groq is encrypted with modern TLS. HSTS is enforced on every public hostname.
Passwords are hashed with bcrypt. WebAuthn passkeys, TOTP, and encrypted recovery codes are first-class. Sessions expire after 120 minutes idle.
2FA secrets, recovery codes, and API keys are encrypted at rest with Laravel's app key. Bearer tokens for the desktop app live in the OS credential store.
Application and database run on Hetzner VPS infrastructure in EU data centres. Backups are encrypted and stay in-region.
Card data never touches our servers. We see your last four and a Stripe customer ID — that's it. Stripe handles PCI-DSS.
Google Analytics 4 for aggregate usage stats — no advertising cookies, no session replay, no fingerprinting SDKs. See the privacy policy for what's collected.
We use a deliberately small number of vendors. Each one is listed below with the data they receive and the role they play.
Receives the audio stream and a filename, returns the transcript text. Zero Data Retention is enabled on our account, which means Groq does not retain audio after processing and does not use it for model training. Hosted in Google Cloud Platform, United States. Cross-border transfers from the EEA rely on Standard Contractual Clauses.
Receives your name, email, and Voca user ID when a billing record is created. Stripe holds your card details under their own PCI-DSS certification. We never see a full card number.
Provides the VPS infrastructure that runs the API and database. EU data centres only. Hetzner does not have access to application data — disks are encrypted and access is keyed to operations staff.
Receives your email address and the body of transactional messages (password resets, billing receipts, invitations) for delivery. We send through AWS Simple Email Service in an EU region. No marketing campaigns run through this channel.
If you believe you've found a security issue, please email [email protected] with the words "security" in the subject. We respond to confirmed reports within two business days. We do not yet run a paid bug bounty programme, but we are happy to credit reporters and we treat reports in good faith.
Please do not test against accounts that aren't yours, do not exfiltrate user data, and give us a reasonable window to fix issues before disclosing publicly. We will do the same in the other direction.
Voca is operated from the Czech Republic and processes personal data under the GDPR. Our data processing arrangements with subprocessors include the EU Standard Contractual Clauses where required. We are not currently SOC 2 or ISO 27001 certified — if you need a formal questionnaire completed for a procurement review, email [email protected] and we will work through it with you.
Security reports: [email protected]
Privacy enquiries: [email protected]
Legal entity: Shay Stephan Lee Punter, Korunní 2569/108, 101 00 Praha - Vinohrady, Czech Republic