What happens to a recording once you send it.

Transfers outside the EU

Oravys, Inc. is based in the United States, as are the payment, e-mail delivery, network security, sign-in and statistics, and AI text drafting providers. These transfers rely on the EU Standard Contractual Clauses in each provider's data processing terms, with encryption in transit and at rest.

EEA-only processing, by contract

Enterprise customers may ask, in their Data Processing Addendum, that audio and reports be processed and stored only within the European Economic Area. On-premise pilots are scoped by contract.

In transit

Data transmitted between your browser and our servers is protected by TLS (version 1.2 or higher).

At rest

Files that are written to storage (free check by e-mail, API jobs, enterprise contracts) are encrypted at rest by Google Cloud with AES-256 and provider-managed keys.

Where a file is written

• Analyses started on oravys.com: processed in memory and freed at the end of the analysis.
• API jobs: stored in the same EU bucket while the job runs and discarded as soon as the result is written.
• Free voice check by e-mail: deleted within 48 hours of upload.

Deletion and custom retention

When a retention period ends or you ask for deletion, the data is deleted from our live systems within thirty (30) days. Enterprise customers may request a written confirmation of deletion, and may set stricter settings for metadata and reports in their Data Processing Addendum. The full schedule is in Privacy Policy, Section 3.2.

No training without opt-in

ORAVYS does not use your audio, your reports, or features derived from your audio to train, fine-tune, evaluate, or improve its AI models, on any plan, unless you tick the Research Contribution box. That box is unticked by default, and the program is currently paused. Enterprise data is never used for training, whatever the settings.

No external AI on audio

All voice analysis is performed by ORAVYS's own software. No audio data is transmitted to any external AI provider. The single exception concerns text, not audio: for Enterprise forensic reports, a narrative summary may be drafted by an external language model from anonymized labels.

Your side

• Account areas and report downloads require an authenticated session.
• API keys are tied to a plan and can be rotated.
• Public free checks run without an account, behind rate limits and a bot challenge.

Our side

• Infrastructure access is restricted to authorised personnel.
• E-mail addresses are hashed before being written to application logs.
• Uploaded files are checked for type, size and duration before analysis.

Report a vulnerability

Our contact for security reports is published in our security.txt file (RFC 9116). Please include the affected URL or component, steps to reproduce and the impact you observed. We do not run a bounty program.

Breach notification

In the event of a personal data breach, ORAVYS will notify the competent supervisory authority within 72 hours of becoming aware of it where required by GDPR Article 33, and will inform affected users without undue delay where the breach is likely to result in a high risk. Enterprise customers with active DPAs are notified within the period set in their DPA.