Security Policy

We employ industry-standard encryption protocols to protect your data both in transit and at rest:

• In Transit Encryption:

  All data transmitted between your device and our servers is protected using TLS 1.3 with strong cipher suites. This ensures that your information cannot be intercepted or read during transmission.

• At Rest Encryption:

  We encrypt all stored data using AES-256 encryption, one of the strongest encryption standards available. This includes your lecture recordings, transcriptions, and personal information.

• Key Management:

  Our encryption keys are managed using secure key management services with strict access controls and regular rotation policies.

We implement comprehensive access controls to ensure only authorized individuals can access your data:

• User Authentication:

  We support strong authentication mechanisms, including complex password requirements and optional two-factor authentication (2FA) to verify user identities.

• Role-Based Access:

  We enforce the principle of least privilege across our systems, ensuring employees have access only to the specific data and systems necessary for their job functions.

• Access Monitoring:

  All access to user data is logged and monitored for suspicious activities, with automated alerts for unusual access patterns.

Our infrastructure is designed with security as a fundamental component:

• Cloud Security:

  We host our services on leading cloud providers that maintain SOC 2, ISO 27001, and other relevant security certifications. Our infrastructure leverages their security features and best practices.

• Network Security:

  We implement network segmentation, firewalls, and intrusion detection/prevention systems to protect against unauthorized access and network-based attacks.

• Regular Updates:

  All systems are regularly patched and updated to address known vulnerabilities, with automated monitoring for security advisories.

• Redundancy:

  Our infrastructure is designed with redundancy to minimize data loss risks and ensure service availability.

We regularly test and verify our security measures:

• Penetration Testing:

  We conduct regular penetration tests by qualified security professionals to identify and address potential vulnerabilities.

• Vulnerability Scanning:

  Our systems undergo regular automated vulnerability scans to detect security weaknesses in our applications and infrastructure.

• Security Audits:

  We perform periodic security audits to ensure compliance with our security policies and industry best practices.

• Third-Party Assessments:

  We engage independent security firms to evaluate our security posture and provide recommendations for improvement.

We maintain compliance with relevant security standards and regulations:

• SOC 2 Type II:

  We maintain SOC 2 Type II compliance, verifying our controls for security, availability, and confidentiality.

• GDPR Compliance:

  Our security practices align with the requirements of the General Data Protection Regulation (GDPR) to protect the privacy rights of European users.

• FERPA Compliance:

  Our platform is designed to enable educational institutions to comply with the Family Educational Rights and Privacy Act (FERPA).

• Regular Assessments:

  We conduct regular compliance assessments to ensure ongoing adherence to these standards and regulations.

In the unlikely event of a security incident, we have comprehensive procedures in place:

• Detection and Analysis:

  We maintain monitoring systems to detect potential security incidents and have dedicated personnel for investigating anomalies.

• Containment and Eradication:

  Our incident response team follows established procedures to contain incidents and eliminate threats to prevent further impact.

• Recovery:

  We have recovery processes to restore affected systems and data to normal operation.

• Notification:

  We will notify affected users in accordance with applicable laws and regulations if their data is compromised.

• Post-Incident Analysis:

  We conduct thorough reviews after any security incident to improve our security measures and prevent similar incidents in the future.

While we implement robust security measures, maintaining the security of your account also requires your participation:

• Strong Passwords:

  Use unique, complex passwords for your Voice Scholar account and consider using a password manager.

• Enable 2FA:

  We strongly recommend enabling two-factor authentication for an additional layer of security.

• Secure Your Devices:

  Keep your devices secure with up-to-date software, anti-malware protection, and screen locks.

• Be Alert:

  Be cautious of phishing attempts. Voice Scholar will never ask for your password via email or message.

• Report Concerns:

  If you notice any suspicious activity related to your account, please contact us immediately.