Security is part of the build.

Nothing to leak from meetings

Speechy does not record meetings and does not store meeting audio, translated audio or transcripts. Audio exists only in memory for the few seconds it takes to translate and play it.

Only the host controls interpretation

• Every request from the Speechy panel carries Zoom's signed, encrypted meeting context, which Speechy verifies before acting.
• Start and Stop are allowed only for a meeting's host or co-hosts, using role information that Zoom sends in signed webhooks (signatures are verified).
• Interpreters join only the meeting the panel is open in, with a one-meeting join token issued by Zoom on the host's behalf, and leave when the host leaves.
• Each meeting is isolated: one meeting's controls cannot see or affect another's.

Data protection

• All connections use TLS (HTTPS / WSS).
• Zoom authorization tokens are encrypted with AES-256-GCM before they are stored.
• The database accepts no connections from the internet; only Speechy's own service can reach it.
• Logs contain no meeting content, tokens or passwords.

Infrastructure

• Interpreter servers accept no inbound connections; they connect out to Speechy with a short-lived signed credential.
• Each server reads only its own environment's settings from an encrypted parameter store, under a least-privilege role. No secrets are stored in server images or in source code.
• Production and testing are fully separate: different servers, databases, credentials and Zoom app credentials.
• Changes are tested automatically and on a separate staging service before they reach production.

Reporting a vulnerability

Email [email protected] with steps to reproduce. Please do not access other people's data, degrade the service, or publish details before we have fixed the issue. We acknowledge reports within two business days.

What we do not claim

Speechy does not currently hold SOC 2, ISO 27001 or HIPAA certifications. Do not use Speechy for meetings that require them.