1. Our Security Measures
- Encryption in transit: All communication between the app, our servers, and third-party providers is encrypted with TLS 1.2+.
- Per-account envelope encryption: Sensitive account data is encrypted at rest using a unique data encryption key per account, itself encrypted by a master key — a single compromised key cannot expose other users' data.
- Credential encryption: Third-party integration tokens (Gmail, Calendar, and other connected services) are encrypted at rest with AES-256-GCM.
- Password handling: Passwords are hashed using a one-way cryptographic algorithm. No Voaise employee can read or recover your password, and we will never ask you for it.
- Authentication: JWT-based session tokens with per-issuer algorithm pinning, and OAuth state parameters protected with HMAC signatures.
- Webhook signature verification: Inbound webhooks — including the telephony call-answer webhook used for call bridging — are verified against each provider's own cryptographic signing scheme (Twilio's HMAC-SHA1 request signature, Plivo's HMAC-SHA256 V2 signature) before being acted on, and payment-provider webhooks are protected with idempotency keys against replay.
- Account isolation: Automated isolation checks verify that one account's data cannot be read through another account's session.
- Rate limiting: Per-device rate limiting helps prevent abuse of the API and telephony/messaging features.
- Local device storage: Data cached on your mobile device (BLE addresses, paired device history, auth tokens) uses MMKV encrypted storage within the app's OS-allocated sandbox.
We conduct regular internal security review of new features and dependencies. No system is 100% secure, and we cannot guarantee absolute protection against every threat — see the Limitation of Liability section of our Terms of Service.
2. Payment Security
Subscriptions and top-up purchases are billed exclusively through the Apple App Store and Google Play Billing. Voaise never receives or stores your credit/debit card numbers, bank account details, or other payment credentials — Apple and Google handle that directly, under their own PCI-compliant infrastructure. We receive only a purchase/subscription token and transaction metadata (see our Privacy Policy, Section 2.6).
3. Cloud Infrastructure
Our database, authentication, and file-storage infrastructure runs on a managed cloud provider with row-level security enforced at the database layer; our application servers are self-hosted. Where a security incident originates at the physical or network infrastructure level of an external provider outside our control, our liability is governed by the Limitation of Liability section of our Terms of Service and by our contractual relationship with that provider.
4. Your Role in Keeping Your Account Secure
Security is a shared responsibility. You are responsible for:
- Keeping your login credentials confidential and not sharing your account with others.
- Using a strong, unique password and enabling any additional sign-in protection your device offers.
- Keeping your device operating system and the VoaiseGlass app updated to the latest security releases.
- Notifying us immediately at security@voaise.com if you suspect unauthorized access to your account.
As described in Section 4 of our Terms of Service, Voaise is not liable for losses arising from unauthorized use of your account that results from a failure to safeguard your own credentials.
5. Reporting a Vulnerability
If you discover a potential security vulnerability in the Service, please report it responsibly to our security team rather than disclosing it publicly. We investigate every report we receive.
Email: security@voaise.com