Security

How we handle your audio, your account, and your incidents.

Vocaler is in private beta. This page is the security posture today and a roadmap to where it needs to be before general availability.

Compliance posture

SOC 2 Type I: in scoping. Target window: Q4 2026.
SOC 2 Type II: follow-on after Type I, target H1 2027.
GDPR: we honour access, export, and deletion requests for any tenant or end-user record we hold — turnaround within 30 days. Contact privacy@vocaler.ai.
CCPA: the GDPR workflow above covers CCPA rights as well.

Data handling

Audio you upload is stored encrypted at rest (AES-256) and in transit (TLS 1.2+).
We do not train any model on your audio, lyrics, or render output. Ever.
Renders and source audio are deleted within 30 days of account closure.
Backups are retained for 30 days and then expire automatically.

Sub-processors

A current list of vendors that touch tenant data. Updated when the list changes; we email Studio and Enterprise tenants 30 days before any addition.

Vendor	Purpose	Region
AWS (S3, RDS)	Storage and database	eu-west-1, us-east-1
Cloudflare	CDN, DNS, Pages hosting	Global
Stripe	Billing	US, IE
Replicate	AI music + motion inference	US
Tailscale	Mac render-farm VPN	Global
Resend	Transactional email	EU

Incident disclosure

We commit to notifying affected tenants within 72 hours of confirming a security incident that involves tenant data.
Status-page updates for service-affecting incidents are posted at status.vocaler.ai.
Post-incident write-ups (timeline, root cause, mitigation) are published within 14 days.

Responsible disclosure

Found a vulnerability? Email security@vocaler.ai with reproduction steps. We respond within 2 business days and credit reporters in the changelog once the issue ships a fix.

Audit + SOC 2 readiness

Studio and Enterprise tenants can request our current SOC 2 readiness summary, sub-processor list with up-to-date attestations, and pentest report at security@vocaler.ai. Documents are shared under NDA.