GoldNovaAI
Security

Security and data handling

Last updated: October 2026

This page states what the product does today, in plain terms, and what we do not claim. It is not a certification and not a contract: the contractual terms are in the privacy policy and the terms. For questions about data processing agreements, use the contact form.

Where your data is processed

  • Database, authentication and file storage (Supabase): the AWS region eu-central-1, Frankfurt, Germany.
  • Application servers (Vercel Functions): configured to run in the Frankfurt (fra1) region. Uploads go from your browser straight to private storage in Frankfurt, and when a recording is processed or a report is built, a Frankfurt server reads the data, handles it in memory and temporary files, and writes the result back. Vercel is a US company and also operates the request routing, logs and website analytics around those servers, and the speech-to-text and AI providers below process data outside the EU. We do not claim that all data stays in the EU.
  • Speech-to-text and optional AI assessment (OpenAI): audio chunks, and for AI assessment the transcript text, are sent to OpenAI’s API. OpenAI may process data in the USA.
  • Payments (Stripe): card details are entered on Stripe’s pages and never reach our servers.
  • Email (IONOS): sign-in and password-reset emails and messages sent through the contact form.

Sub-processors

Supabase (database, authentication, storage), Vercel (hosting and application servers, website analytics), OpenAI (speech-to-text and optional AI assessment), Stripe (payments) and IONOS (email). Voice platforms you connect (Vapi, Retell, Twilio) send data to us at your request; they are your providers, not ours. Transfers outside the EEA, in particular to the USA, rely on the providers’ agreements; see the privacy policy for the terms we have published so far.

Recordings and transcripts

  • Recordings are stored in a private bucket that is not publicly reachable. Playback uses signed links that expire after minutes (10 by default), created on our servers only for members of the owning organization.
  • Each organization is a separate workspace. Access is enforced by database row-level security and by explicit organization filters in the server code, and is covered by automated isolation tests on a real Postgres database and against the hosted preview.
  • API keys and OAuth tokens are stored only as one-way hashes. Credentials for provider connections (Retell, Twilio) are encrypted with AES-256-GCM. Passwords are handled by our authentication provider and are never stored by us in readable form.
  • Uploaded files are validated on the server from their actual content (not their name), refused if they are not audio, and removed from storage when refused.
  • Encryption, exactly scoped: traffic to the application uses HTTPS. The only data we encrypt ourselves, at application level, are the provider credentials above (AES-256-GCM). Recordings, transcripts and database content are not encrypted by an additional layer of ours; they rely on the encryption at rest and in transit that our hosting providers apply on their platforms, which we have not independently audited. Our servers must read recordings and transcripts in readable form to process them, so this is not end-to-end encryption.
  • Sensitive content: a recording or transcript contains whatever the speakers say, including personal data and possibly special categories of data. An optional Voice QA rule can flag spoken card numbers, IBANs, email addresses and US social-security-style numbers and shows them masked in the report; it does not remove them from the stored transcript and it does not detect other personal or special-category data. Do not send content you have no right or need to process.

Retention and deletion

  • Raw audio files (Voice QA calls and research interviews) are deleted from storage 90 days after upload by a daily job; uploads that were never completed are removed by the same job. You can delete a recording earlier, with or without its call. This 90-day rule covers the audio file only.
  • Transcripts, QA reports, evidence quotes and findings are retained separately and are not deleted after 90 days. They are kept until you delete the call, interview or project, or your account. Deleting a call removes its recording, transcript, evaluations and evidence; deleting your account removes the organizations you alone belong to and cancels their subscriptions with Stripe first. Billing and tax records are kept as long as the law requires.
  • Deleting a call does not give back the call, audio or AI allowance it used, so allowances cannot be reset by deleting data. The allowance counters hold no call content.
  • Backups: our database provider keeps rolling daily backups of the production database; point-in-time recovery is not enabled. When we last checked (18 October 2026) the provider listed about a week of daily snapshots. Data you delete in the app can therefore remain in a database backup until that backup ages out, and we do not edit backups individually. We have not tested a restore and have not confirmed the retention period in writing from the provider, so treat “about a week” as an observation, not a promise. Recordings are files in storage, which database backups do not contain; deleted recording files are removed from storage itself.

Logs

Our application logs record identifiers, event names, statuses and durations, not audio or transcript text. Error messages from unexpected failures are truncated before they are logged. Our hosting provider also keeps technical request logs (which can include IP addresses) for a limited period.

AI and model training

We do not use your recordings, transcripts or findings to train any model of our own. Transcripts and optional AI assessments are produced by OpenAI’s API under its API terms; according to OpenAI’s published API data-usage terms, API inputs are not used to train its models by default and may be kept for a limited period for abuse monitoring. We have not enabled zero data retention. The optional AI assessment is off unless a rule uses it, and its output is only accepted with verbatim transcript quotes.

What we do not claim

  • No certification of any kind: this page describes our own measures and is not an audit report. No SOC 2, ISO 27001 or HIPAA attestation or readiness, and no third-party penetration test to date.
  • No data processing agreement (Auftragsverarbeitungsvertrag) is concluded by default or published as a template; where you send personal data of third parties, agree one with us first through the contact form.
  • No guarantee that using GoldNovaAI makes you GDPR-compliant: you remain responsible for your own legal basis, recording consent and information duties. Results are QA signals for human review.
  • No “all data stays in the EU”, no zero-retention processing, and no guarantee of 100% availability.

Reporting a problem

If you believe you have found a vulnerability, write to hello@goldnovaai.com. We will acknowledge it and look into it; we do not run a bug-bounty programme.

Security and data handling · GoldNovaAI