1. Transport and origin protection
Vocaic is served over HTTPS through a content delivery network (CDN). The origin server is configured to accept requests only through the CDN rather than directly from the public internet, which reduces its exposure. For safety, this page does not publish secrets, internal header names, credentials or instance details.
2. Tokens, sessions and passwords
Vocaic has no user accounts and stores no passwords. Talk seat tokens and investor session tokens are random values that are stored only as SHA-256 hashes, never in the clear, and are delivered as HttpOnly, SameSite=Lax cookies (Secure over HTTPS). The investor session expires eight hours after assent; a Talk seat token lasts up to the room’s 24-hour retention window.
3. Short retention
Keeping little data limits the impact of any incident. Talk-room content is deleted 24 hours after the room’s last activity, Accent Studio audio uploads are deleted after transcription, and the translation cache stores text pairs without identity. The Privacy Notice has the full retention table.
4. Rate limits and abuse controls
Vocaic applies rate limits and request-size caps on room creation, messaging, translation and investor access to protect the shared service, and rejects cross-origin form posts. These controls exist to keep the service available for everyone; do not attempt to evade them (see the Acceptable Use Policy).
5. Developer API keys
The Agent API authenticates with Bearer keys you create in the console on the developers page. A key is shown once; Vocaic stores only its SHA-256 hash, so it cannot recover or re-display a key. Keys can be revoked. The API enforces per-key rate limits (60 requests per minute and 5000 per day), caps each delivery at 10 recipients, applies a shared daily cap, and limits request and audio sizes. Delivered audio is addressed by an unguessable 128-bit link and is deleted after 24 hours. Keep your keys secret and out of client-side code you ship; treat a key as a credential that can act on your behalf.
6. Responsible disclosure
If you find a security issue, please report it to agarw574@purdue.edu with the word Security in the subject line. Give enough detail to reproduce the issue, and allow a reasonable time to investigate and fix it before any public disclosure. Vocaic will not pursue good-faith security research that respects this process, avoids privacy violations and service disruption, and does not access or modify data beyond what is needed to demonstrate the issue.
7. Out of scope
The following are generally out of scope: denial-of-service or volumetric testing, social engineering of people, physical attacks, spam or automated scanning noise, findings that require a rooted or compromised device, and reports about missing best-practice headers without a demonstrated impact. Service providers listed on the Subprocessors page have their own disclosure programs.