1. Our Security Measures

• Encryption in transit: All communication between your browser, our servers, and third-party providers is encrypted with TLS 1.2+.
• Per-account envelope encryption: Sensitive account data is encrypted at rest using a unique data encryption key per account, itself encrypted by a master key — a single compromised key cannot expose other users' data.
• Credential encryption: Third-party integration tokens (Gmail, Calendar, and other connected services) are encrypted at rest with AES-256-GCM.
• Password handling: Passwords are hashed using a one-way cryptographic algorithm. No Voaise employee can read or recover your password, and we will never ask you for it.
• Authentication: JWT-based session tokens with per-issuer algorithm pinning, and OAuth state parameters protected with HMAC signatures.
• Account isolation: Automated isolation checks verify that one account's data cannot be read through another account's session, and row-level security is enforced at the database layer.
• Rate limiting: Per-device rate limiting helps prevent abuse of the API and Service.

We conduct regular internal security review of new features and dependencies. No system is 100% secure, and we cannot guarantee absolute protection against every threat — see the Limitation of Liability section of our Terms of Service.

2. Payment Security

Subscriptions and top-up purchases are processed securely through certified payment gateways verified by the relevant authorities. Voaise never receives or stores your credit/debit card numbers, bank account details, or other payment credentials — you enter them directly into the payment provider's secure interface, under their PCI-compliant infrastructure. We receive only a tokenised reference and transaction metadata (see our Privacy Policy, Section 2.4).

3. Cloud Infrastructure

Our database, authentication, and file-storage infrastructure runs on a managed cloud provider with row-level security enforced at the database layer; our application servers are self-hosted. Where a security incident originates at the physical or network infrastructure level of an external provider outside our control, our liability is governed by the Limitation of Liability section of our Terms of Service and by our contractual relationship with that provider.

4. Your Role in Keeping Your Account Secure

Security is a shared responsibility. You are responsible for:

• Keeping your login credentials confidential and not sharing your account with others.
• Using a strong, unique password and enabling any additional sign-in protection your device offers.
• Keeping your browser and device operating system updated to the latest security releases.
• Notifying us immediately at security@voaise.com if you suspect unauthorized access to your account.

As described in Section 4 of our Terms of Service, Voaise is not liable for losses arising from unauthorized use of your account that results from a failure to safeguard your own credentials.

5. Reporting a Vulnerability

If you discover a potential security vulnerability in the Service, please report it responsibly to our security team rather than disclosing it publicly. We investigate every report we receive.

Email: security@voaise.com