Security

We keep the measures on this page to what is actually in place. Access is limited to what each part of the system needs, credentials are never stored in readable form, and every request to your data has to be authenticated as you.

• The website is served over HTTPS only, with HTTP Strict Transport Security
• The API, database, cache and file storage run as separate services; the database and cache are not exposed to the internet
• Rate limiting on the API and on sign-in, per API key or per address
• Database backups are taken regularly and kept in separate storage, under credentials the application does not hold

Physical Security

Physical security of the servers — building access, surveillance and power — is provided by our hosting provider's data centre.

Data in Transit

• Connections use TLS 1.3 or 1.2; older versions are refused
• HSTS tells browsers never to connect over plain HTTP

Credentials

• Passwords are hashed with bcrypt and never stored in plaintext
• API keys are stored as SHA-256 hashes; only a short prefix is kept readable so you can tell your keys apart
• Access tokens are signed JWTs that expire after one hour

• Administrative functions require the administrator role and are not part of the public API
• Sign-in is throttled: repeated failed attempts block further tries for a period
• Sensitive account and administrative actions are recorded in an audit log
• Access to production systems is limited to the people who operate the Services

Your audio files, generation history and account data are reached only through authenticated requests tied to your account. Download links to generated files are signed and expire.

If we find a security incident, we contain it first, then investigate the cause, restore affected systems from backup where needed, and change what allowed it.

User Notification

If a data breach affects your personal information, we will notify you within 72 hours of confirming it, with the nature of the breach, the data affected, the likely consequences and what we are doing about it.

We process personal data under the EU General Data Protection Regulation and Turkey's KVKK. You can delete your account and its data at any time, and ask us for a copy of what we hold; see our GDPR page. We do not currently hold a third-party security certification.

We invite security researchers to report potential vulnerabilities in our Services.

How to Report

Please send vulnerability reports to hi@prosodyai.ai, the contact named in our security.txt.

Our Commitments to Researchers

• Acknowledge receipt of your report within 2 business days
• Keep you informed of our progress while we fix it
• Not pursue legal action against researchers who follow responsible disclosure practices

Scope

In-scope targets include all *.prosodyai.ai domains and our published APIs. Out-of-scope items include third-party services, physical security attacks, and social engineering.