Security

How Viton protects workspace and respondent data.

Authentication

• Passwords are hashed with scrypt at high work factor, with parameters stored alongside the hash and transparently upgraded on sign-in.
• Optional time-based one-time-password (TOTP) two-factor authentication.
• Changing a password invalidates every existing session and every outstanding reset link.
• Platform-operator access additionally requires a verified email and enabled two-factor authentication.

Tenant isolation

Every survey, response, recording and report is scoped to a workspace, and every read is checked against the caller's workspace. Respondent rows carry their workspace key directly so isolation is enforced at the query, not only in application code.

Data handling

• Recordings are stored privately with unguessable keys and served only through authenticated, tenant-checked routes.
• Per-workspace retention windows are enforced by a nightly purge that deletes the audio and erases the transcript and analysis it produced — survey answers and Voice Analyzer clips alike.
• Deleting a survey, an analysis batch or the whole workspace erases its recordings, not just the database rows.
• API keys are stored only as a hash, are shown exactly once, and open a single workspace — a key can never read another tenant's data.

Operational controls

• Rate limits on authentication, respondent submission, analysis and the export API, configured to fail closed on the paid paths.
• A per-workspace monthly spend ceiling on AI analysis, enforced before any provider call.
• An append-only audit log of sign-ins, invitations, exports and destructive actions, visible to workspace admins.
• Content Security Policy, HSTS, frame-ancestors deny, and camera/microphone permissions scoped to the app itself.

Verifiable reports

Exported reports and slide decks carry a verification code: a keyed signature over the workspace, the issue date, the number of answers covered, and a digest of the figures on the page. Anyone holding the document can check it at /r/verify without an account.

What a valid code proves is narrower than “this document is unaltered”, and we would rather write the narrow thing. It proves that this deployment issued a report for that workspace, on that date, covering that many answers — and that those claims have not been touched, because one changed character breaks the signature.

It does not read the document you are holding. The content digest travels inside the code but is never recomputed against your copy, so nothing on our side can notice a retyped paragraph. The comparison is yours to make: check the workspace, date and count the verification page shows you against the document in front of you, together with the short fingerprint printed beside the signature. Nothing else about the report is disclosed.

Regional controls

Optional facial expression capture runs entirely in the respondent's browser, is off by default, requires explicit consent, and is blocked across the EU in line with the AI Act.

Reporting a vulnerability

Please report security issues to security@goldinkollar.com. We will acknowledge within two business days and will not pursue action against good-faith research.