Microsoft Azure edition
Security
How the service is built, isolated and operated on Microsoft Azure.
Runtime
The web service and the asynchronous worker run on Azure Container Apps as stateless containers, deployed by immutable image tag, in West US 3. Records are stored in Azure Database for PostgreSQL, audio in Azure Blob Storage, and work is queued through Azure Queue Storage. Components authenticate to each other with a managed identity; secrets live in Azure Key Vault and there are no long-lived credentials in images or environment variables.
Access control
Sign-in uses Clerk, with the sign-in form served on this site and the same instance behind every console, so one account works on every cloud. Every request is verified against Clerk's session token signature and its audience, and sign-out revokes the session at Clerk. Browser write requests require a same-origin Origin header and a unique Idempotency-Key. API keys are shown once, stored hashed, and scoped to one organisation. The console may use the microphone for its own voice-verification recording only, and nothing else on the page can.
Model services
Speech synthesis, watermarking and fingerprinting run as private services with no public address, reachable only from the worker over the environment's internal network with a shared secret. Provider keys a customer connects are stored in the platform vault and decrypted only for that customer's requests. Every generated file is watermarked before it leaves the model service, so no unmarked audio exists in transit.
Data handling
Uploaded and generated audio is private by default, isolated per organisation, and expires after 24 hours. Public resolution reads only fields the holder chose to publish. Request bodies, audio and recipient identifiers are kept out of the operational log stream. Backups and version history are encrypted at rest by the platform.
Reporting
Report a vulnerability to security@gridheap.com. Include reproduction steps and give us a reasonable opportunity to remediate before public disclosure; we acknowledge reports before publishing anything about them and we do not pursue good-faith researchers who respect this page.