Vocloner security and privacy

Product security by design

Vocloner separates public surfaces from authenticated areas. Account, Studio, library, history, and admin pages require a session and are not part of the site’s indexable content.

Sensitive operations are validated on the server. The browser does not decide permissions, quotas, active plans, voice ownership, or webhook validity.

• Input and file validation before processing.
• Rate limits for generation, checkout, reports, and webhooks.
• Access controls for voices and private storage.
• Audit records for administrative actions and security events.

Recordings, voices, and audio

Reference recordings, consent evidence, and private voices are not public by default. Private resources use access controls and, where appropriate, short-lived signed links.

A public voice appears only after the user publishes it with the required consent and it passes applicable internal controls. A report may quarantine it during review.

Consent and abuse prevention

The consent flow records the accepted text version and may associate a timestamp, IP address, verification challenge, evidence audio, and technical results. These data help investigate disputes and are not presented as universal speaker identification.

Vocloner may not be used for impersonation, fraud, harassment, phishing, non-consensual content, cloning children’s voices, model extraction, or limit evasion. Reports can be submitted without an account from the abuse page.

Payments and providers

Checkout is delegated to the payment provider shown for your region. Vocloner receives identifiers, status, plan, amount, and billing events, but does not store a full card number or security code.

Synthesis, authentication, storage, captcha, analytics, and hosting may involve external providers. Each feature shares only what is needed to perform the requested operation and is subject to the Privacy Policy.

Reporting a vulnerability

If you find a security issue, email support@vocloner.org. Include reproduction steps, impact, affected URL or component, and a safe way to contact you. Do not include passwords, tokens, or other people’s data.

We ask for responsible disclosure: do not disrupt the service, access other accounts, download information, or publish the issue while we investigate it. Response and recognition depend on severity and available information.