Trust · Security

Security at SpeechKey

Last reviewed: 2026-05-15 Posture: privacy-first, recovery-first

Security and privacy aren't a feature page — they're the architecture. Below is how we treat audio, transcripts, keys and the systems that carry them. We update this page as our infrastructure matures.

01Our approach

SpeechKey is engineered around three principles:

  • Minimise. Don't collect what isn't needed. Don't keep what isn't useful.
  • Isolate. Your data stays in the operating system's per-app sandbox on your device. Every secret is fetched at the lowest level of trust required.
  • Recover. Resilience is a security property: a system that can't reconnect under pressure leaks data through retries, copies and improvised fallbacks. We engineer recovery so that the secure path stays the easy path.

02Encryption

  • In transit: TLS 1.3 for every connection between the app and the AI providers you connect. Strict transport security and certificate pinning on the mobile client.
  • On device: API keys and transcripts are held in the platform secure storage (iOS Keychain) and protected by the device's hardware-backed encryption.
  • No server-side copy: we hold no database of your audio, transcripts or keys — there is nothing on our side to encrypt or breach, because your content never reaches us.
  • Enterprise customer-managed keys (CMK): available for managed enterprise deployments only.

03API key handling (BYOK)

Your AI provider keys never leave your device in plain text:

  • Keys are encrypted on-device using the iOS Keychain (hardware-backed where available).
  • Audio and text are sent directly from your device to your chosen provider — your keys are never transmitted to SpeechKey.
  • We operate no server that could receive or store your keys; only the device that uses a key can read it.
  • You can remove any key at any time — removal deletes it from the device secure store.

04Access control

  • SpeechKey has no user accounts — there is no login, no password and no server-side identity to compromise.
  • Access to the app is controlled by your device itself; an optional biometric lock (Face ID / Touch ID) can gate sensitive views such as transcripts and key management.
  • Because there are no accounts, there are no sessions, tokens or credentials for us to manage or leak.
  • Managed enterprise deployments can add SSO (SAML 2.0, OIDC) and role-based access control where a managed environment is required — these apply to enterprise contracts only, not the consumer app.

05No SpeechKey cloud

  • SpeechKey runs on your device. Your audio and text go directly from the app to the AI provider you connect — there is no SpeechKey server in the data path.
  • We run no database of your conversations: transcripts, keys and settings live on your device, not in a cloud we operate.
  • The only first-party online surface is this static marketing and legal website, which is cookie-free and stores nothing about you.
  • Managed enterprise deployments that require a backend are provisioned separately under their own contract and region controls.

06On-device data

  • Your transcripts, keys and settings are stored only on your device, isolated by the operating system's per-app sandbox.
  • Because we run no multi-tenant backend for the consumer app, there is no cross-customer data that could leak between users.
  • Enterprise single-tenant or dedicated deployments are available under contract for organisations that need a managed environment.

07Secure transmission

  • All audio and text are streamed over TLS (WebSocket-over-TLS or HTTP/2 over TLS) directly from your device to your chosen AI provider.
  • There is no SpeechKey server in the path to intercept or store the stream.
  • Reconnect and retry paths use the same encrypted, direct channels as the primary path. No fallback to unencrypted transport, ever.

08Logging philosophy

We run no server that receives your audio or transcripts, so there is nothing on our side to log.

  • Audio is never written to disk except the transcript history you explicitly choose to keep on your device.
  • Transcript content stays on your device and is never sent to us.
  • This website collects no analytics about you and sets no cookies.

09No back-end access to your content

  • We hold no server-side access to your audio or transcripts, because your content never leaves your device for our systems.
  • Support staff cannot see your transcripts; you share them only via in-app flows you initiate.
  • For managed enterprise deployments, any operator access is audited, time-bound and requires explicit approval.

10Security monitoring

  • Continuous vulnerability scanning of the app's dependencies and release pipeline.
  • Hardened build process; every change is reviewed and version-controlled.
  • Annual third-party penetration tests of the app; remediation tracked to closure.
  • Bug bounty programme (private, expanding to public after general availability).

11Responsible disclosure

If you believe you have found a security issue, please report it to security@vaitl.ai.

  • We acknowledge reports within 24 hours.
  • We commit to investigating in good faith, keeping you informed and crediting you (if you wish) once an issue is resolved.
  • We will not pursue legal action against researchers acting in good faith and following our disclosure policy.
PGP A PGP key for encrypted reports is published at vaitl.ai/.well-known/security.txt.

12Incident handling

  • 24×7 on-call rotation. Documented runbooks for the most likely failure modes.
  • If a confirmed personal-data breach affects you, we notify you and the relevant supervisory authority within the 72 hours required by GDPR Art. 33.
  • Post-incident reviews are conducted blame-free, with actionable follow-ups tracked publicly on the status page where appropriate.

13Compliance posture

  • GDPR — aligned; DPAs available on request.
  • SOC 2 Type II — readiness programme in progress; first audit window announced in advance to enterprise customers.
  • ISO 27001 — roadmap item; controls mapped internally.
  • App Store / Google Play — full compliance with privacy-label and data-safety requirements.

See our Compliance overview for the full posture.

14Contact

Security is a moving target. This page reflects our current posture and will evolve.