Learn about Sayify.pro's security practices, data protection, and compliance.
Security Overview
Security and privacy are foundational to Sayify.pro. Here's how we protect your data.
Data Encryption
- In transit: All connections use TLS 1.2+ (HTTPS enforced)
- At rest: Audio files and transcriptions are encrypted on AWS S3 with AES-256
- API keys: Hashed before storage — the full key is shown only once at creation
Authentication
Session-Based (Dashboard)
The web dashboard uses session cookies with CSRF protection. Sessions expire after inactivity.
API Key (Programmatic)
API access uses Bearer tokens. Include your key in the Authorization header:
Authorization: Bearer sk_live_YOUR_API_KEY
:::warning Keep Keys Secure
Never expose API keys in client-side code, public repositories, or logs. Rotate keys regularly and revoke any that may be compromised.
:::
API Key Best Practices
| Practice | Why |
|---|---|
| Use separate keys per environment | Isolate production from dev/staging |
| Set descriptive names | Know which key is used where |
| Revoke unused keys | Reduce attack surface |
| Monitor usage stats | Detect anomalous usage early |
Permissions
- API tokens inherit the permissions of the workspace they belong to
- Each workspace is isolated — tokens from one workspace cannot access another
- Team members can be invited with scoped permissions
Webhook Security
Webhook payloads are signed with a secret token (whsec_...), allowing you to verify that requests genuinely come from Sayify.pro. Always validate signatures before processing webhook payloads.
Data Retention
- Voice recordings are retained for the duration of your subscription
- Transcriptions and AI insights are stored alongside responses
- You can delete individual responses or entire links through the dashboard or API
- Account deletion removes all associated data
Compliance
- GDPR: We support data portability and deletion requests
- Privacy Policy: Available at sayify.pro/privacy/
- Terms of Service: Available at sayify.pro/terms/
- Cookie Policy: Available at sayify.pro/cookie-policy/
:::note Data Location
All data is processed and stored on AWS infrastructure in the US East (Virginia) region.
:::