Security measures

1. About this page

This page lists the security measures we have checked in our own systems. It does not list measures we have not verified. Our privacy policy explains what personal data we hold and how we use it.

2. Accounts and sign-in

• Passwords: we store passwords only as hashes, using PBKDF2-SHA256 or bcrypt, and never store the password itself.
• Multi-factor authentication: available with an authenticator app, email codes or SMS codes. You can turn it on in your profile.
• Sign-in cookie: signed so that it cannot be altered, marked HttpOnly so that scripts on the page cannot read it, and sent only over HTTPS. It lasts 24 hours and is renewed while you use the site.
• Sign-in emails: we send no more than 3 email sign-in codes to an address in 10 minutes.

3. API keys

• We store API keys only as SHA-256 hashes.
• Each key has its own rate limit, by default 60 requests a minute and 5,000 a day, and can be limited to certain models.
• API rate limits are counted per key, not per IP address.

4. Connections

Our sign-in cookie is set so that browsers send it only over HTTPS connections.

Our website and API work only over HTTPS: plain HTTP is redirected, and browsers are told to use HTTPS only.

5. Website protections

• Content Security Policy: our pages may load scripts, styles and fonts only from our own server. Other sites cannot show our pages inside a frame, and our pages cannot submit forms to other sites.
• Other security headers: we send headers that stop browsers guessing the type of content, limit the address information sent to other sites when you follow a link, restrict browser features, and keep our pages separate from windows opened by other sites.
• No caching of pages: pages other than static files are sent with an instruction not to store them in caches.
• No third-party code: our fonts, icons and scripts are served from our own server. We use no analytics, advertising or tracking scripts.
• Payment details: you enter card and bank details on Stripe's and GoCardless's own pages. Our code has no fields for card or bank details.

6. Where data is stored

• The VoltaAI service, its database, cache and memory components run on our own servers in the UK.
• Our mail server and our search server are hosted by Hetzner in Germany. Emails we send go through the mail server, and web search queries through the search server.
• Images and documents are stored with Wasabi in the UK.
• We run our code runner and web page reader ourselves, not with a third party.

Our sub-processors page lists every provider that handles personal data.

7. Staff access

• Our admin console is open only to administrator accounts.
• The VoltaServices billing portal uses a separate service key to create and update accounts and keys.
• Administrators can view account records, conversation content and images.

8. Automatic deletion and redaction

• Every day, we delete generated images and uploaded documents that are more than 30 days old, from both our database and our file storage.
• When our service restarts, it deletes files attached during a chat that are more than 1 hour old.
• In our log of the emails we send, we remove one-time codes and the security tokens in links. The links themselves are not removed. Each entry is deleted after 90 days.
• When we record what a tool was asked to do, we remove any field named like a secret.
• The counter we use to limit feedback form submissions by IP address expires after 2 hours.

Our privacy policy sets out how long we keep each kind of data.

9. What is not yet in place

• Account deletion and full data export are handled by request through privacy@voltaservices.co.uk while self-service tools are built.
• Encryption of stored data: we do not add our own encryption to data stored in our database, such as your messages. The disks of our UK servers, which hold your account, chats and memory, are encrypted.

10. Reporting a security issue

If you find a security issue in VoltaAI, email privacy@voltaservices.co.uk with enough detail for us to reproduce it. While testing, please do not access other people's data, change data or disrupt the service, and give us reasonable time to fix the issue before you tell anyone else.

If you think someone has used your account without your permission, reset your password, turn on multi-factor authentication and tell us at privacy@voltaservices.co.uk.