Security and Vulnerability Disclosure

Last updated: October 2026

This page covers two things: how Speecho protects the audio and the account you trust us with, and how to report a security problem if you find one.

How your data is protected

• Encrypted in transit. Every connection uses TLS: your browser to us, and us to each provider that processes your audio or text. The site and the app are served over HTTPS only.
• Encrypted at rest. The database and the private object storage that holds kept audio and voice clips are encrypted at rest by their providers, Neon and Cloudflare R2. Stored audio is never public; it is reachable only through short-lived links issued to the account that owns it.
• Audio is not kept by default. An upload or a live session is streamed for recognition and then gone. A copy is stored only if you switch on "Keep audio" yourself, and it expires with the transcript after 90 days or the moment you delete it. Handwriting photos are processed in memory and never written to disk.
• Passwords are hashed. We store a bcrypt hash and nothing else, so nobody here can read your password. Sign-in codes and password-reset tokens are stored as hashes too: a stolen copy of the database cannot be replayed against the service.
• Sessions can be ended. Changing your password signs out every other device automatically, and the account panel has a button that ends all other sessions on demand.
• Card details never reach us. Payments go to Paddle, our Merchant of Record. We receive the order id and the amount, never the card.
• No training on your data. The AI providers we use process your audio and text for inference only. They are listed with links to their policies in our privacy policy.
• You can erase it. Any transcript, any kept recording and the whole account can be deleted at any time, and deletion removes the stored audio along with the text.

Speecho is run by one person, which keeps the number of people who can reach production data at one. We do not hold a SOC 2 or ISO certification and we do not claim one.

For your IT or procurement team

The short version, for the person who has to approve a tool before a meeting:

• Where the data lives. The servers and the database are hosted in the United States. Kept audio and voice clips live in Cloudflare R2 object storage.
• Who else touches it. The speech, text and AI providers that process audio and text are listed by purpose, with links to their policies, in the privacy policy. None of them trains on your data.
• How long it stays. Audio is discarded after recognition unless you turn on "Keep audio". Transcripts expire after 90 days or when you delete them, whichever comes first.
• Who you pay. Purchases are made through Paddle, our Merchant of Record. The receipt and invoice come from Paddle, VAT is calculated and collected at checkout, and a VAT-registered business can enter its VAT ID there. Card details never reach Speecho, and refunds (14 days, no questions asked) go back through Paddle to the original payment method.
• Who to ask. Questions from a security or compliance review go to support@speecho.app and get an answer within 5 business days.

How to report

• Email support@speecho.app. The same address is listed in /.well-known/security.txt.
• Include exact steps to reproduce, the affected URL or endpoint, and what you observed. A request and response, or a short screen recording, is more useful than a long description.
• You will get a reply within 5 business days. Confirmed issues are fixed as fast as their severity requires, usually within days.

No bug bounty

Speecho does not run a bug bounty program and does not pay for vulnerability reports. Please do not ask about rewards before or after sending a report. If you want, we will credit you by name on this page once the issue is fixed.

Reports that consist of a scanner output, a generic template, or a claim without reproduction steps will not receive a reply. Examples of things we already know about and do not consider vulnerabilities:

• Missing or "misconfigured" security headers, SPF, DKIM or DMARC records reported without a working exploit.
• Rate limiting, password length limits, or "denial of service" claims that were not actually demonstrated against the service.
• Email enumeration through sign-up, login or password reset responses.
• Clickjacking on pages with no authenticated actions, or self-XSS.
• Version disclosure of third-party software, or issues in third-party services that we do not control.

In scope

• speecho.app and its language subpaths (the marketing site and free tools).
• my.speecho.app (the application).
• api.speecho.app (the API behind the application).

Rules

• Test only against accounts you own. Do not access, modify or delete other users' data, even if a bug makes it possible; stop and report instead.
• No automated scanning or load testing against production. It affects real users and is the one thing that will get an IP blocked.
• Give us reasonable time to fix an issue before disclosing it publicly.

Thank you for helping keep Speecho safe for the people who use it.