SECURITY
How we protect your account and data
A plain-language look at the concrete measures behind ProfileVoice, not a marketing checklist.
Account authentication
Sign-in is handled by Amazon Cognito. Your session is stored in an httpOnly, encrypted cookie that browser JavaScript cannot read, with a separate token used to guard state-changing requests against cross-site request forgery.
Payments
Card and PayPal payments are processed entirely by Stripe and PayPal — your card number never reaches ProfileVoice's servers. Checkout happens on Stripe/PayPal's own hosted, PCI-compliant pages.
Generated content storage
Images, videos, and other generated assets are stored in Amazon S3 with server-side encryption at rest (AES-256). Invoice PDFs are kept private and served only through short-lived, time-limited links generated on request — never as permanently public files.
Data in transit
All traffic between your browser and ProfileVoice is encrypted over HTTPS.
Rate limiting & abuse protection
Sensitive actions like checkout are rate-limited per account to guard against automated abuse, separate from normal usage limits on everyday actions like viewing your billing history.
Access to your data
Every request for your billing history, invoices, or payment methods is checked against your authenticated account — your data is scoped to you and isn't reachable by other accounts.
Found a security issue or have a question? Email us directly at hello@profilevoice.io — we take reports seriously and will respond promptly.