VoiceSeal security incident notice
Service status: restoredService status: VoiceSeal has been rebuilt on replacement infrastructure and service has been restored.
What happened
On October 22, 2026, we learned of a security incident affecting infrastructure where VoiceSeal’s service credentials were stored. Those credentials could potentially have enabled unauthorized access to connected databases and storage. We confirmed unauthorized use of one third-party AI-service credential; that finding does not establish that VoiceSeal customer information was accessed.
What information may be involved
Potentially affected information includes names, email addresses, password hashes and account records; associated consent and voice-licensing records; and, for users who enrolled a voice, stored voice embeddings derived from enrollment recordings. A voice embedding is a numerical representation of characteristics of your voice, rather than an audio recording. VoiceSeal uses it to compare voices. Account passwords were stored as salted bcrypt hashes rather than plain text. Full payment card numbers are not stored on our systems.
We have not determined whether this information was accessed, copied or altered without authorization. Historical access logging was not enabled on the relevant data stores, which limits our ability to confirm or rule out access.
What we have done
We isolated the affected environment, rotated high-value service credentials and revoked identified exposed credentials. VoiceSeal has now been rebuilt and restored on replacement infrastructure. Our checks of the restored database identified no evidence of unauthorized account creation, privilege changes or other modifications within the scope reviewed. These checks do not establish whether information was previously read or copied. We have enabled additional logging and strengthened access controls.
Notifying affected users
We have sent direct notices to potentially affected VoiceSeal users, with separate notices for enrolled-voice and account-only users.
What you can do
- Be cautious of unexpected messages referring to VoiceSeal, your voice enrollment or licensing activity. We will never ask you to send your password, full payment card details or a voice recording by email.
- As a precaution, change your VoiceSeal password by visiting voiceseal.io directly and use a unique password. If you reused that password elsewhere, change it on those services too.
- If you receive an unexpected request involving your voice or identity, verify it through a separate, trusted channel.
Questions
VoiceSeal’s incident-response contact is security@gooverio.com. Please contact us with questions or reports of suspicious activity. Do not include passwords, payment details or voice recordings in your message.
Further updates
We will share material findings and any further protective steps as our review progresses.
Updates across affected Gooverio Labs products are available at gooveriolabs.com/status.
Updates
- Incident identified. Payment credentials rotated, misused API key disabled. VoiceSeal experiencing degraded service. Migration to new infrastructure underway.
- Notice revised: scope and cause not yet established; investigation has not confirmed a wider compromise of the hosting provider’s platform. Affected environment isolated, database password rotated, credential and access-record review under way. VoiceSeal temporarily unavailable pending restoration on replacement infrastructure.
- Service restored on replacement infrastructure. Notice updated to reflect restoration and the information potentially involved, including password hashes (stored as salted bcrypt). Checks of the restored database found no evidence of unauthorized account creation, privilege changes or other modifications within the scope reviewed; whether information was previously read or copied is not established. Preparing direct notices to potentially affected users.
- Direct notices sent to potentially affected users, with separate notices for enrolled-voice and account-only users.