Keeping it safe.

• Our website and live servers run on Render, in its Virginia region (United States).
• Our database and sign-in run on Supabase, in its us-east-1 region (Virginia, United States).
• Speech recognition, translation, the AI voice, email and payments, and, once we switch them on, error reports and the bot check on our sign-in forms, are done by the companies on our privacy page, which says what each one receives and where it works.

In transit. Every page, every live connection (the sound from the desk, the captions and the AI voice) and every call from our servers to our providers goes over HTTPS or secure WebSockets, encrypted with TLS. Our site tells browsers to reach it only over HTTPS (HSTS), and webhooks are sent only to https addresses.

At rest. Supabase, which holds our database, states that all customer data is encrypted at rest with AES-256 and in transit with TLS. Card details are held by Stripe, which states that an auditor certified it to PCI Service Provider Level 1; we never see full card numbers. Service audio, captions and the AI voice pass through our servers’ memory and are not written to disk; transcripts a church chooses to save go to the database.

• Each church sees only its own information. A church’s members can read only their church’s data, and the database itself enforces that (row-level security), not only our screens. The key that can read across churches is kept only on our servers, for their own code.
• Roles within a church: owners, admins and operators each see and change only what their role allows. API keys, webhooks and cloned voices are managed by owners and admins only.
• Signing in: sign-up starts with a link sent to your email, so every account belongs to an address its owner reads. Passwords are at least 10 characters and our sign-in provider keeps only a hash of them, and choosing a password signs you out everywhere else. You can also continue with Google.
• API keys are shown once and stored only as a hash. A booth key reaches only rooms and the service buttons, and each key may make 120 requests a minute. Webhook deliveries are signed (HMAC-SHA256) and go only to public https addresses, checked again as each one is sent.
• Limits against abuse: the parts of the site anyone can use without an account, such as the visit counter, the demo’s link check and the opt-out form, limit how often one network address can call them.
• Our own access: only the people who run Voclyn can reach our production systems, and our admin panel is open only to the addresses we name.
• Signed-in pages can’t be shown inside another site’s frame, so a lookalike page can’t lay itself over them.

• Service audio is never stored. It streams from the sound desk to our live server and on to speech recognition, and is discarded as it is processed. The AI voice is held in memory only for the few seconds it takes to play.
• Transcripts are saved only when a room’s “Save transcripts” is on, which it isn’t until the church turns it on, and they are deleted automatically after the plan’s period. A private moment at the desk hides captions on every phone and saves nothing.
• A recording for a cloned voice passes through our server to the voice provider and is never stored by us; the copy sent to check the spoken consent is deleted at our speech-recognition provider once it has been read.

Supabase backs up our database as our Supabase plan provides: on its Pro plan, one backup a day, kept for 7 days; its Free plan takes none for us. Something deleted from the database can remain in a backup until that backup expires.

Not verified yetWhich Supabase plan our production database is on, and so whether a daily backup is being taken today.

• No security certification of our own, such as SOC 2, and no outside security audit or penetration test.
• No two-step sign-in. Sign-in links go to your email, so keep that account safe.

If information is lost, stolen or seen by someone who shouldn’t have seen it, we tell the churches affected without undue delay, and the regulator and the people affected where the law requires. Our data processing addendum has the detail.

Found a weakness? Write to hello@voclyn.com. A person reads every message. Please give us time to fix it before telling others, and look at no more of anyone’s information than you need to show the problem.