Security

How Viton protects workspace and respondent data.

Authentication

• Passwords are hashed with scrypt at high work factor, with parameters stored alongside the hash and transparently upgraded on sign-in.
• Optional time-based one-time-password (TOTP) two-factor authentication.
• Changing a password invalidates every existing session and every outstanding reset link.
• Platform-operator access additionally requires a verified email and enabled two-factor authentication.

Tenant isolation

Every survey, response, recording and report is scoped to a workspace, and every read is checked against the caller's workspace. Respondent rows carry their workspace key directly so isolation is enforced at the query, not only in application code.

Data handling

• Recordings are stored privately with unguessable keys and served only through authenticated, tenant-checked routes.
• Per-workspace retention windows are enforced by a nightly purge that deletes the audio and erases the transcript and analysis it produced — survey answers and Voice Analyzer clips alike.
• Deleting a survey, an analysis batch or the whole workspace erases its recordings, not just the database rows.
• API keys are stored only as a hash, are shown exactly once, and open a single workspace — a key can never read another tenant's data.

Operational controls

• Rate limits on authentication, respondent submission, analysis and the export API, configured to fail closed on the paid paths.
• A per-workspace monthly spend ceiling on AI analysis, enforced before any provider call.
• An append-only audit log of sign-ins, invitations, exports and destructive actions, visible to workspace admins.
• Content Security Policy, HSTS, frame-ancestors deny, and camera/microphone permissions scoped to the app itself.

Verifiable reports

Exported reports and slide decks carry a verification code: a keyed signature over the workspace, the issue date and a digest of the figures on the page. Anyone holding the document can check it at /r/verify without an account. The check confirms the document came from us and has not been altered; it discloses nothing about its contents.

Regional controls

Optional facial expression capture runs entirely in the respondent's browser, is off by default, requires explicit consent, and is blocked across the EU in line with the AI Act.

Reporting a vulnerability

Please report security issues to security@goldinkollar.com. We will acknowledge within two business days and will not pursue action against good-faith research.