Voxt Security
Voxt's security model starts with reducing unnecessary data movement: local channels can process voice and text on your Mac, while remote model calls are opt-in through providers you configure. The website and API use HTTPS/TLS, account credentials are protected with hashed passwords, and full payment-card data is handled by the payment processor rather than stored by Voxt.
The short answer
Voxt's security model starts with reducing unnecessary data movement: local channels can process voice and text on your Mac, while remote model calls are opt-in through providers you configure. The website and API use HTTPS/TLS, account credentials are protected with hashed passwords, and full payment-card data is handled by the payment processor rather than stored by Voxt.
Key takeaways
- Local model channels reduce the amount of voice and text that leaves your Mac.
- Remote ASR/LLM use is a deliberate configuration choice and inherits the provider's security and retention terms.
- Website and API traffic is protected with HTTPS/TLS; passwords are stored hashed.
- Voxt does not currently claim SOC 2, ISO 27001, HIPAA, or other certification unless a separate, current notice says so.
Security controls in scope
These controls describe the current product and website posture; they are not a substitute for a customer-specific security review.
Local-first processing
When local ASR and LLM channels are selected, the model step happens on the Mac. This reduces exposure to a hosted inference service, but users still need to secure the Mac, local files, and installed models.
Encrypted website transport
Website and API traffic uses HTTPS/TLS. Do not paste API keys into support messages or expose them in screenshots, logs, prompts, or public repositories.
Credential and payment boundaries
Account passwords are stored hashed, and full card numbers and security codes are handled by Waffo Pancake rather than stored on Voxt servers. OAuth providers handle the identity data they return under their own policies.
Consent-aware analytics
Optional GA4 measurement loads only after analytics consent. Events are limited to page, download, sponsor, GitHub, and funnel measurement and exclude voice content, transcripts, selected text, prompts, payment details, and API keys.
What this page does not promise
Clear boundaries are part of a useful security page.
No blanket provider guarantee
BYOK providers have their own infrastructure, data retention, region, and training policies. Choosing a local Voxt channel is the stronger control when content must remain on-device.
No certification claim
Voxt does not use this page to claim SOC 2, ISO 27001, HIPAA, PCI certification, or a formal enterprise compliance program. Payment processing is delegated to the payment processor as described in the Privacy Policy.
No risk-free promise
Security depends on the Mac, operating system, model provider, account, API keys, and workflow configuration. Keep software updated, use a strong account credential, and choose providers that meet your requirements.
Report a security issue
Please report suspected vulnerabilities privately so they can be investigated responsibly.
Contact
Email security@voxt.actnow.dev with the affected page or version, reproduction steps, impact, and a safe way to follow up. Do not include live API keys, passwords, private transcripts, or unnecessary personal data.
Account or privacy request
For personal-data questions or deletion/access requests, use privacy@voxt.actnow.dev as described in the Privacy Policy.
FAQ
Does Voxt have SOC 2 or HIPAA certification?
Voxt does not currently claim SOC 2, HIPAA, ISO 27001, or another formal compliance certification on this site. If your organization requires one, contact Voxt before using the product for regulated workloads.
How does local processing improve security?
Local processing can keep voice audio, transcripts, prompts, and enhancement results on the Mac for the model step, reducing the need to send them to a hosted inference service. It does not remove the need to secure the device or local data.
What should I do if I expose an API key?
Revoke or rotate the key with the provider immediately, remove it from public logs or repositories, and contact security@voxt.actnow.dev if the exposure involved Voxt infrastructure. Never send the live key in an email or screenshot.