Security & data handling

When you upload an audio file to the audit API, it is sent over HTTPS to our Cloudflare-backed API gateway, forwarded to our Cloud Run service for auth + billing, and then handed off to a Modal GPU worker that runs the actual analysis. Results are written back to Firestore so you can review them from the dashboard, and the original audio files are kept in Cloudflare R2 for as long as the audit is retained.

We do not use your audio content to train, fine-tune, or evaluate our machine-learning models. Your audio exists in our system solely so that you can replay and debug the results of the audit you ran.

By default, audio files and audit results are retained for 30 days. After that, a Cloudflare R2 lifecycle rule automatically deletes the audio objects; the audit metadata (scores, flags, scripts) remains in your dashboard history as a compact record.

Audits that you explicitly share from your dashboard are a deliberate exception: as long as the share is active, the audio files stay accessible so that the people you shared the link with can continue listening. Revoke the share (or delete the audit) and the files become eligible for deletion on the next cleanup cycle.

You can delete any audit at any time from the dashboard. Deleting your account purges all of your audits, API keys, and personal data; payment and tax records are retained for the period required by law.

Dashboard users authenticate through Firebase Authentication (email/password or Google). Programmatic API callers pass an opaque X-API-Key header (or Authorization: Bearer <key>); keys are hashed with SHA-256 before storage and we have no way to retrieve the original after creation. You can rotate or revoke keys at any time from the dashboard.

Firestore security rules restrict each user to their own audits, credits, API keys, and usage history. Agent-driven x402 calls authenticate by signing a payment authorization with the caller’s wallet — there is no persistent account for anonymous x402 traffic.

TTSAudit staff (the company founders and a small set of support engineers) can access customer audits when required for support, abuse investigation, or product debugging. We do this only when it is necessary and will never share your audio data with third parties outside of the service providers listed below.

Cloudflare provides DDoS mitigation, bot scoring, and per-IP rate limiting at the edge. Signup and authentication flows are protected by Firebase Authentication's built-in anti-abuse controls and risk signals.

Every x402 payment is verified against Coinbase CDP's facilitator before we run the underlying audit, so unauthenticated traffic cannot exercise GPU compute without paying.

TTSAudit is built on a small set of reputable managed-service providers so that we can stay focused on the audit logic instead of running our own data center. The primary components are Google Cloud (Cloud Run, Firestore, Cloud Functions, Secret Manager), Modal (GPU audio processing), Cloudflare (DNS, CDN, WAF, R2 object storage), Render (edge API proxy), Stripe (card billing), and Coinbase CDP (x402 facilitator).

All of these providers carry their own compliance certifications (SOC 2, ISO 27001, PCI DSS) under their respective programs. TTSAudit itself is not separately SOC 2 or ISO 27001 certified — we rely on our providers for infrastructure-layer compliance and focus our own controls on application security.

Secrets (API keys, signing keys, third-party credentials) live in Google Cloud Secret Manager and are mounted into Cloud Run and Modal at deploy time. No secrets are committed to the repository.

If you believe you have found a vulnerability in TTSAudit, please email hi@ttsaudit.com with details. We will acknowledge your report within two business days and work with you on disclosure. We do not currently run a bug bounty program but we are happy to credit researchers who report responsibly.