Security and Trust.

How we protect your data

• Encryption. Data is encrypted in transit (TLS 1.2 or higher) and at rest in production storage.
• Access. Named individual accounts for everyone with production access, least privilege, multi-factor authentication on cloud consoles, and access removed as soon as someone leaves.
• Logging. Every production access is logged, and unusual activity is reviewed. Security logs are kept for 12 months.
• Backups. Regular encrypted backups with tested restores.
• Hosting. Our services run on Amazon Web Services and Microsoft Azure. The regions in use and our subprocessors are listed on the subprocessors page.
• Separation. After a customer turns training off, no new copy of its data enters the model-training environment.

How we handle AI

• We train our models on a separate copy of customer data with names, emails and the account link removed, kept for up to 3 years after the customer's last activity. Every customer can turn this off at any time in their account settings.
• We never give voice artists' recordings or voice models to any third party, and every artist is paid for each paid use of their voice.
• Every generated audio file carries an inaudible watermark, and we keep generation records for up to 12 months to investigate misuse.
• No voice is cloned without its owner's documented consent, and public figures' voices are blocked.

Compliance

• With a specialist partner, we are working towards ISO/IEC 27001 and ISO/IEC 42001 certification, and alignment with the UAE Personal Data Protection Law, the UAE Information Assurance standards, the National Cloud Security Policy and CSA STAR Level 1. We hold no certification yet, and we will update this page when we do.
• Our security policies and latest assessment results are available to enterprise customers under NDA through security@echonova.ai.

Reporting a vulnerability or incident

Send any security vulnerability or suspected incident to security@echonova.ai. We reply within two business days. We will not take legal action against researchers who report in good faith, access no data other than their own, do not disrupt the service, and give us reasonable time to fix the issue before any disclosure.