What will happen to the audio you send us
People send recordings of a relative who sounds frightened, calls that claim to come from a bank, and material they have not shown to anyone else. That is not ordinary file upload. This page exists so it can be checked later against what we actually build.
Truthring has not launched, so nothing here describes a running system. It states what we are committing to: encrypted transport, audio erased once analysis ends, a one‑way hash kept in place of the file, no model training on submissions without an explicit opt‑in, and no certification claimed until an auditor has issued one.
Why every sentence below is in the future tense. A security page that describes controls in the present tense, for a product nobody can yet use, is a claim that collapses under one question from a competent buyer. We would rather publish the promises now, date them, and be held to them at launch. Where a decision genuinely has not been taken, the page says so in the margin instead of filling the gap with a plausible-sounding number.
The path a clip will take
Four stages, in the order they will happen. Each one is a place where a promise can be broken, so each one is stated separately.
Upload
The file will travel over TLS and nothing else. The minimum protocol version and cipher set we intend to enforce is [VERIFY: TLS minimum version and cipher policy not fixed] A submitted clip will never be written to a location that can be read without authentication, and no upload URL will be guessable from a Ringmark or a filename.
Analysis
Where the engine runs is not settled: [VERIFY: hosting provider and region not selected] The commitment that does not depend on that choice is this one. If any part of the analysis is performed by a company other than Lacewing Technologies, that company will be named here, with what it receives and where it holds it, before a single member of the public submits a recording. A page that says “trusted partners” and stops has disclosed nothing.
Storage
Audio held between upload and deletion will be encrypted at rest. How keys are generated, rotated and separated from the data they protect is [VERIFY: key management design not finalised] The window itself — how long anything survives, and which of the four things we hold survives longest — is set out on data retention rather than summarised loosely here, because a retention number that appears in two places will eventually disagree with itself.
Deletion
Deleting a submission will remove the audio and the features derived from it. The Ringmark and the verdict will remain. That asymmetry is deliberate: a result somebody has already relied on, quoted in a letter or handed to an editor, should not quietly become uncheckable because the submitter later tidied up an account. The reasoning is explained in full on the retention page.
The questions people actually ask
These are the six that arrive first, from consumers and from procurement alike. Where the honest answer is that we have not decided, that is the answer given.
Will you train on my audio?
Not without an explicit opt‑in, off by default, and revocable. That is the commitment. The exact control, and the treatment of audio already contributed by someone who later changes their mind, are [VERIFY: opt-in mechanics not built]
Can a person there listen to it?
Only for a support request the submitter raised, an abuse investigation, or a processing fault — and every access will be logged. Whether the account holder is notified afterwards is [VERIFY: staff-access notification policy not decided]
Who else will touch the file?
Nobody, today, because there is no service and no sub‑processor. The list will not stay empty. Every processor will be named here with its role and its location, and the list will be dated so additions are visible. [VERIFY: sub-processor list not yet populated]
Where will it physically sit?
Undecided. [VERIFY: storage region not selected] Lacewing Technologies operates from Navi Mumbai under Indian law, which shapes the choice but does not settle it. Whether a customer will be able to pick a region is a separate open question.
Can I use it without an account?
The intention is yes, for a limited number of checks. Anonymous use matters to somebody investigating a person who has access to their inbox. Whether that survives contact with abuse and cost is [VERIFY: anonymous-use limits not fixed]
What if you are compelled to hand it over?
We will publish what we receive and what we produce, and we intend to notify the person concerned wherever the law permits it. The policy, and the statistics that are currently zero for want of any users, sit on transparency.
What we are not claiming
Stated plainly, so that nobody has to infer it from silence.
- There is no certification of any kind. No SOC 2 Type I or Type II, no ISO 27001, no ISO 27701, no independent security audit, no penetration test report, anywhere in Lacewing Technologies or its products. If an approved-supplier process requires an attestation, Truthring cannot pass it today. Learning that here costs you a minute; learning it in week three of a procurement cycle costs both of us considerably more.
- There is no uptime record and no service level. A system that has never carried traffic has no availability history, and a percentage invented for a page like this one would be worthless.
- There is no bug bounty programme. We will read what you send and answer it. We are not going to describe that as a programme, because it has no budget, no scope document and no published safe harbour yet.
Truthring is not a secure custody service
This is the sentence most likely to matter to somebody with a live dispute. If a recording is evidence in a legal matter, in a regulatory complaint or in an internal investigation that could end someone’s employment, hold your own original and preserve your own chain of custody independently of us. Copy the file to storage you control, record where it came from and who has touched it, and do that before you upload anything anywhere.
What a Ringmark gives you is narrower and more honest than custody. It ties one analysis to one file and one engine version, so the result can be identified later even though the audio itself is gone. It records what we examined and what we returned. It does not preserve your evidence, it does not establish that the recording is authentic in any legal sense, and it will not stand in for the original if you are asked to produce one. Our compliance page covers what a court or a regulator is likely to want alongside it.
Reporting a security problem
Send it to security@aivoicedetctor.com. Include enough detail to reproduce the issue and tell us how you would like to be credited. We have no formal response-time commitment to offer yet [VERIFY: vulnerability disclosure response commitment not set] and we would rather leave that blank than publish a number we have never had to meet. We will not pursue a researcher who reports a finding in good faith and gives us a reasonable chance to fix it before publishing.
Questions we get asked twice
Is any of this already running?
No. Truthring has not launched, there is no live detector behind this website, and no member of the public has yet sent us a recording. Everything on this page is a commitment about the system we are building, dated so it can be checked against what exists on the day the service opens.
Do you hold SOC 2 or ISO 27001?
No. Truthring holds no security certification, and neither does Lacewing Technologies, the company behind it. No third party has audited our infrastructure, our code or our controls. If your procurement process requires an attestation report, we cannot satisfy it today and we will not pretend otherwise.
Will you train your models on the audio I send?
Our commitment is that submitted audio will not be used to train or tune any model unless the submitter has opted in explicitly, on a control that is off by default and reversible afterwards. The wording of that control, and what happens to audio already contributed if someone later withdraws, are still being settled.
Can one of your staff listen to my recording?
We are committing to a narrow set of circumstances — a support request the submitter raised, an abuse investigation, or a fault the engine could not process — and to logging every access. Whether the account holder is told after the fact is not yet decided, and it is one of the questions we would rather answer in public than quietly.
Where will the audio be stored?
The hosting provider and region have not been chosen. Lacewing Technologies is based in Navi Mumbai and operates under Indian law, so a region decision has consequences for both transfer rules and latency. We will name the provider, the region and every sub‑processor on this page before the first clip is accepted.
Trust
How detection works
If you have a recording now
Reviewed