Invite-only
Release 1 is intended to remain a private alpha, not an open self-service product.
Security & privacy
Security and privacy in the VoxForge private alpha.
VoxForge handles the substance of product conversations, so trust cannot be a launch-day footnote. This page separates safeguards already present in the prototype from the controls that must be complete before Release 1.
Alpha posture · Last reviewed 24 August 2026
Not retained by default
The Release 1 policy is intended to avoid raw-audio retention by default. Final provider and operating details are part of the release review.
Limited alpha retention
Transcripts, events and artifacts will be subject to a limited alpha policy. A public numeric period has not yet been set.
Present in the prototype
Concrete safeguards in the current architecture.
Provider credentials stay server-side
Transcription and model-provider keys belong in the server process and are not exposed through client build variables, meeting events, snapshots or browser error payloads.
Generated artifacts are treated as untrusted
Generated HTML is data, not server code. The product renders it in a restricted iframe and applies a server-controlled content security policy before persistence.
Commands and events are validated
Shared runtime schemas validate commands and events at process boundaries. Revision text is bounded and escaped, and SQLite access uses prepared statements.
Evidence must come from research results
Claim-checking output may cite only sources returned by the configured research provider. No returned evidence means the result remains “needs evidence.”
Release gates
Controls that are requirements, not finished claims.
Authentication
Approved identity and invite flows must be complete before external alpha access.
Workspace isolation
Server-side tenant boundaries and negative cross-workspace tests are part of the release gate.
Retention and deletion
Final alpha periods, deletion behaviour and provider-specific handling must be documented and verified.
Operational readiness
Restore testing, incident handling and provider-data-flow review must match the approved Release 1 architecture.
Plainly stated
What we are not claiming.
VoxForge is not currently presented with SOC 2, ISO 27001 or HIPAA certification; an enterprise SLA; contractual RPO or RTO; universal zero-data-retention from every AI provider; or guaranteed UK-only processing for every service. Stronger paid-production controls can be evaluated after the private alpha and architecture gates.
Ask a security or privacy questionPrivate alpha
Evaluate the product and its trust model together.
Early design-partner conversations can include your privacy, retention and workspace-isolation requirements without pretending the alpha is already an enterprise compliance programme.