A certificate and a control are not the same thing
A compliance badge tells you that an auditor looked at a company on a particular day. It does not tell you whether the audio from your call was written to a disk, or which network the words in it crossed. Those are different questions, and it is the second one that matters when you are deciding whether to run a translator over a confidential meeting.
So this page is built the other way round. Instead of a badge, each section names the mechanism, says where the data goes, and points at the place you can verify it. We hold no certificate and no third-party attestation — that is stated plainly further down, alongside everything else we cannot claim.
Where your data actually goes
VoxisLive runs on your machine and talks to two kinds of server: our own, which knows about your account and your minutes, and a cloud translation engine, which hears the audio and sends back the translated speech. Which engine depends on the language you asked to hear — some target languages are served by Google, others by Alibaba Cloud.
| What | Where it goes | Kept after the session? |
|---|---|---|
| Live audio from your speakers or microphone | Transmitted over an encrypted WebSocket to the cloud engine that serves your target language — Google or Alibaba Cloud | No. It is transient and is not written to disk. |
| Your account and your minute balance | Our own server | Yes — that is what a subscription or a minute pack is made of. |
| Speech detection and speaker-change detection | Your own CPU | Nothing leaves the machine. |
| Transcripts and exports | Documents\Voxis\Transcripts, on your disk | Yes, until you delete them. |
| A problem report you choose to send | Our server, after the log has been scrubbed on your device | Only what you ticked to attach. |
That routing is not a preference you have to trust us about: the target language you pick in the app decides it, and the audio path that carries it is part of the code excerpt we publish — see licensing for what that repository is and is not.
What stays on your machine
Several of the things people assume are cloud features run on your own CPU, because that is where they are cheapest and where they leak least:
- Speech detection. A Silero voice-activity model runs locally and decides which parts of the stream are speech. Silence does not become network traffic.
- Speaker-change detection. A CAM++ model computes a voice embedding on your CPU to notice when the voice in the room changed, so transcripts can be split into S1 / S2. The embedding never leaves the device. What it does is speaker-change detection: it notices that the voice changed, it does not work out who is speaking, and it keeps no voiceprint.
- The free tier's voice. On the free tier the spoken output is synthesised locally by a neural voice on your own machine, downloaded once on first use.
- Problem-report scrubbing. When you send a report, the log is redacted on the device before it is sent, and the redaction is fail-closed: if the scrub cannot complete, nothing is sent at all.
Your meeting text stays on your disk
Transcripts are written to Documents\Voxis\Transcripts on your own machine, one folder per session, alongside any TXT, SRT or VTT export you generate from it. They are not uploaded, not indexed, and not readable by us. Deleting the folder deletes the record — there is no copy on our side to ask about.
There is one exception, and you have to press it. The post-session AI summary button sends that session's saved transcript text to a cloud model to be summarised, on request, for that one session. Nothing summarises automatically, and a session you never press it on never leaves the disk.
The code that does it is readable
We publish a curated, read-only excerpt of the audio-handling code — capture, the on-device detection described above, the network hop to the engine, playback, and local transcript storage — so that your security team can read the claims on this page in the form they were actually implemented, rather than in the form a marketing page states them.
Two honest limits on that. It is an excerpt: it deliberately omits the files needed to build or run the application, so it is for verification, not for compiling your own copy. And it is published all-rights-reserved, not under an open-source licence. The full terms, and what reading it does and does not permit, are on licensing.
Bring your own key: we leave the audio path
If the question your legal team is really asking is "can we avoid a new data processor altogether", the BYOK unlock answers it. With your own Google Gemini or Alibaba Qwen API key, the app opens the engine session using your key, which means the audio never reaches Voxis servers at all — the processing relationship is directly between you and the engine vendor you already have a contract with.
The key itself is stored encrypted on your device with Windows DPAPI, bound to your account and that install, not held on our side. BYOK is a paid one-time unlock rather than a free mode; see pricing and licensing for what it covers.
For teams: pinning a licence to one engine
Organisations that have cleared one cloud vendor through review and not the other usually cannot accept per-language routing between two of them. For those licences, an operator can pin the engine routing to a single engine, so every session on that licence uses the vendor your review approved regardless of the target language.
This is an operator-side setting on a licence, not a toggle inside the app, so it is arranged when the organisation plan is set up — contact us and say which engine your review cleared. Meeting-specific behaviour is described on meetings.
What we do not claim
This is the part most trust pages leave out, so it is the part worth reading twice.
- No certificate. We are not ISO 27001 certified and we hold no SOC 2 report. We do not display compliance badges, because we have none to display.
- No third-party attestation. Nobody independent has audited the claims on this page. The evidence we offer is the published code excerpt and the behaviour you can observe on your own machine — that is a different and weaker kind of assurance than an audit, and we are not going to call it one.
- No BAA. We do not sign Business Associate Agreements, so we are not a fit for workflows that require one.
- No EU-only processing guarantee. The audio goes to the cloud engine serving your target language; we do not promise it is processed exclusively inside the EU, and we will not pretend otherwise to win a procurement form.
- No accuracy guarantee. This is machine interpretation with a delay of a few seconds. It is not a certified interpreter, and it should not be the record of anything legally binding.
If your process requires any of those today, we are the wrong vendor for that workflow — and saying so now costs everyone less than being found out at the security-review stage.
Sub-processors and paperwork
In the default configuration there are two parties in the audio path besides you: the cloud translation engine serving your target language (Google or Alibaba Cloud), and our own server, which sees your account and the minutes you spent but not the audio. In BYOK mode, only the engine vendor remains, on your own key. The current list, along with what is retained and for how long on our side, is kept in the privacy policy; the contractual side is in the terms.
If your legal team needs data-processing paperwork beyond those documents, write to us through contact and tell us what has to be in it. We handle those case by case, and we would rather tell you early what we cannot sign than route around the question.