Security
Naija Transcribe is built so that the most sensitive thing, your audio, never reaches us. This page explains what we do to keep the rest safe, who else is involved, and how to tell us about a problem.
Service status
See live service status: whether the app, the voice-pack downloads, translation and the contact form are working right now. Transcription itself runs on your device, so once your voice pack is downloaded it keeps working even when our servers or your internet are down.
How your data is protected
- Audio and transcripts stay on your device unless you choose Quick mode. Speech recognition normally runs in your browser; in Quick mode the recording goes to our own server in London and is deleted right after transcription. Recordings and transcripts are stored only in your browser's storage, and you can delete them, or set them to delete automatically, from My recordings.
- Only text you choose to translate leaves your device, after you agree, and only to the translation provider listed below, which is asked not to store or train on it.
- No accounts, no cookies, no advertising or third-party analytics. Usage is counted without identifiers; see the privacy notice.
- Encrypted connections only: HTTPS everywhere with HSTS.
- Strict browser protections: a Content Security Policy that only allows code from our own site and our voice-pack host, framing blocked, cross-origin isolation, and the microphone allowed only on our own pages.
- No third-party code at run time: the speech library, runtime and fonts are served from our own hosting, not public CDNs.
- Abuse controls: every server route checks where requests come from and is rate-limited per address; message and translation sizes are capped.
- Secrets (API keys, our inbox address) are held as encrypted server settings, never in the page or in code.
- Minimal logs: our server keeps error logs only, for a short period, and never logs transcript or message content.
Providers that handle data (subprocessors)
| Provider | What for | What they receive | Where |
|---|---|---|---|
| Oracle Cloud (London, UK) | Quick mode transcription server (only if you choose it) | The recording you send; deleted after transcription | United Kingdom |
| Cloudflare | Hosting, voice-pack storage, usage counts, secure tunnel to our server | IP address and request details; contact messages in transit | Global network |
| OpenRouter | Routing translation requests | Only transcript text you choose to translate | United States |
| Anthropic (via OpenRouter) | Translation model (Claude) | The same text | United States |
| Resend | Delivering contact-form messages | Your email, name, topic and message | European Union (Ireland) |
| Zoho | Our email inbox | Contact-form messages | Provider's data centres |
We will update this list before adding a new provider that receives personal data. More detail, including the legal basis for each, is in the privacy notice.
Report a vulnerability
If you find a security problem, please tell us through our contact form and choose "Security issue". Include what you found and how to reproduce it. We will acknowledge your report within 3 working days and keep you updated until it is fixed.
- Please test only against your own data, don't access or change other people's data, and don't run denial-of-service or automated scanning that degrades the service.
- Give us reasonable time to fix the issue before you make it public.
- If you act in good faith under these rules, we will not take legal action against you.
- We don't run a paid bug bounty, but we are glad to credit you once the issue is fixed.
Machine-readable contact details are in security.txt.
Certifications
Naija Transcribe is a small, free service and does not hold SOC 2, ISO 27001 or similar certifications, and has not had an independent penetration test. We describe what we do above rather than claim a badge. We follow the Nigeria Data Protection Act 2023 and, where it applies, the UK and EU GDPR.
Incidents
If an incident affects your data, we will tell affected people and the regulator as the law requires. Past incidents and planned maintenance are listed on the status page.