AES-256
Encryption at Rest
All biometric embeddings are encrypted with AES-256 before storage. Encryption keys are managed via HSM abstraction layer.
TLS 1.3
Encryption in Transit
All API traffic uses TLS 1.3. HTTP requests are rejected. HSTS enforced on all endpoints.
JWT + OAuth
Authentication
Signed JWT tokens, Google OAuth support, 5-attempt brute force lockout with 15-minute backoff window.
8-Band
Audio Watermarking
Imperceptible 8-subband watermarks are embedded into enrolled voice prints for offline traceability.
SHA-256
Hash-Chained Audit
Every data access, consent event, detection hit, and payout action is written to a tamper-evident, SHA-256 hash-chained audit log — any alteration of historical records breaks the chain and is detectable. Chain heads are anchored daily to Bitcoin via OpenTimestamps for independent third-party verification.
BIPA
Compliance
Full biometric consent infrastructure: grant, withdraw, export, and deletion endpoints with timestamped records.
Member — Content Authenticity Initiative
VoiceSeal is an approved member of the Content Authenticity Initiative (CAI), the industry coalition behind the C2PA open standard and Content Credentials — backed by Adobe, Microsoft, Google, BBC, and Sony. Membership approved July 9, 2026. C2PA manifest embedding is deployed; certified signing with DigiCert targets Q3 2026.
Built on Certified Infrastructure Providers
VoiceSeal has not yet completed its own SOC 2 examination. The certifications below are held by our infrastructure providers.
Application and API hosting on Railway and Vercel, both SOC 2 Type II attested, with automated deployment isolation.
Biometric artifacts and audio stored on Cloudflare R2 — ISO 27001 certified, SOC 2 attested — behind Cloudflare's global network security layer.
Infrastructure certifications cover the physical, network, and platform layers. VoiceSeal's application controls — AES-256 biometric encryption, hash-chained audit logs, and the consent lifecycle — operate above that certified foundation.
Organization-level SOC 2 Type I: scheduled with our first enterprise contract cycle.
Responsible Disclosure
Found a security vulnerability? We have a responsible disclosure program and commit to acknowledging all valid reports within 48 hours.
🔒 Report a Vulnerability