Microsoft Azure edition
Security
How the service is built, isolated and operated on Microsoft Azure.
Runtime
The web service and the asynchronous worker run on Azure Container Apps as stateless containers, deployed by immutable image tag, in West US 3. Records are stored in Azure Database for PostgreSQL, audio in Azure Blob Storage, and work is queued through Azure Queue Storage. Components authenticate to each other with a managed identity; secrets live in Azure Key Vault and there are no long-lived credentials in images or environment variables.
Access control
Sign-in uses Clerk, with the sign-in form served on this site and the same instance behind every console, so one account works on every cloud. Every request is verified against Clerk's session token signature and its audience, and sign-out revokes the session at Clerk. Browser write requests require a same-origin Origin header and a unique Idempotency-Key. API keys are shown once, stored hashed, and scoped to one organisation. The console may use the microphone for its own voice-verification recording only, and nothing else on the page can.
Model services
Speech synthesis and speaker-approved training run through authenticated, server-side provider adapters. DNSMOS quality analysis runs in the existing CPU ONNX service. Browsers never receive provider credentials or call a GPU service directly. Original recordings and durable model manifests remain in Speech Name storage. Provider keys a customer connects are stored in the platform vault and decrypted only for that customer's requests. Generated files are watermarked before leaving the controlled processing path.
Data handling
Uploaded and generated audio is private by default, isolated per organisation, and expires after 24 hours. Public resolution reads only fields the holder chose to publish. Request bodies, audio and recipient identifiers are kept out of the operational log stream. Backups and version history are encrypted at rest by the platform.
Reporting
Report a vulnerability to security@gridheap.com. Include reproduction steps and give us a reasonable opportunity to remediate before public disclosure; we acknowledge reports before publishing anything about them and we do not pursue good-faith researchers who respect this page.