Skip to content

A receipt forevery voice.

Every clip ECHO accepts will be issued a public receipt linking the audio to the contributor’s consent, the licence they agreed to, and their payment. Anyone can check one.

Files are hashed on your device. Nothing is uploaded.

Live receipts

Receipts appear here seconds after a clip is accepted.

0
Receipts issued
0
Consent records
0
Payouts linked
25
Controls tracked

Computed from the ledger at build time.

Most recent receipts
EventReceiptLanguageWhen

The ledger opens with the first voice.

No contributions have been accepted yet.

Be one of the first

What a receipt proves

Recorded

The contributor reads a prompt in the app.

Consented

The task’s purpose and licence version are attached.

Hashed

The audio’s SHA-256 becomes its permanent address.

Reviewed

Quality and transcript checks, by machine and by people.

Paid

The contributor’s payout is linked to the receipt.

Licensed

Datasets ship with a manifest of every receipt inside.

receipt.jsonSample, not a real record
{
  "receipt": "sha256:9f2c…e41a",
  "event": "registration",
  "language": "yo-NG",
  "task": "scripted",
  "speaker": "spk_7Q…",          // pseudonymous
  "consent": {
    "licence": "echo-train-eval-v1",
    "agreed_at": "…",
    "purpose": "speech recognition training"
  },
  "review": "accepted",
  "payout": "paid"
}

Where we stand, stated plainly.

ECHO is pre-launch. Nothing below is claimed as certified until it is, and each line will carry its date and evidence when it changes.

GDPR

In development

EU General Data Protection Regulation

Consent, access, export and deletion flows are being built into the contributor app.

CCPA / CPRA

In development

California Consumer Privacy Act

Same rights model as GDPR, applied to California residents.

BIPA

Planned

Illinois Biometric Information Privacy Act

Voice can be biometric data. Written consent and retention schedules before any Illinois collection.

SOC 2 Type II

Planned

Independent controls audit

Audit window to begin once production infrastructure is in place.

Independent security review

Planned

Third-party penetration test

Before the contributor app opens to the public.

Public receipt ledger

In development

Every accepted clip gets a public receipt

This page. Receipts appear here from the first accepted contribution.

Audit controls

Every control behind a receipt, grouped by what it protects, each with its real status.

Contributor identity

Who can contribute, and how we know they are who they say.

  • Identity verification

    Government ID matched to the contributor once, at onboarding, before any receipt is issued.

    Before first payoutPlanned

  • Liveness check

    A short spoken challenge at the start of each session confirms a live person is recording.

    Every sessionPlanned

  • Own voice only

    Contributors attest that every recording is their own voice. Duplicate and synthetic voices are screened before acceptance.

    Per clipIn development

  • Anti-coercion limits

    Session and daily limits, device checks and attestations make bulk or coerced recording impractical.

    In development

  • De-identification

    Identity never reaches a receipt or a dataset. Each contributor is an opaque speaker ID.

    By designIn development

Data handling

What is collected, what is kept, and what is never shared.

  • Pseudonymous datasets

    Datasets carry a speaker ID and self-described attributes only. Never names, contact details or exact location.

    In development

  • Sensitive signals stay private

    IP addresses, GPS, device identifiers and audio fingerprints never appear on receipts. Receipts record only whether a check passed.

    Existence flags onlyIn development

  • Minimal website data

    Forms collect only what is needed to reply. IP addresses are stored as keyed one-way hashes and purged within 24 hours.

    Live

  • No advertising use

    Personal data is never sold or used for advertising.

    Live

  • Retention schedule

    Waitlist data is deleted 24 months after last contact, or on request.

    Live

  • Data residency

    EU contributors' audio stored in the EU; other regions stored in-region where required.

    Planned

Security

How systems and data are protected.

  • Encryption in transit

    All traffic served over TLS.

    TLSLive

  • Abuse protection

    Signed form tokens, honeypot fields and per-connection rate limits on every form.

    Live

  • Encryption at rest

    Audio and metadata encrypted at rest in production storage.

    In development

  • Least-privilege access

    Production access limited by role, logged and reviewed.

    Planned

  • Vulnerability disclosure

    Security reports are accepted through the contact page and acknowledged by a person.

    Live

Audit and verification

How anyone can check the claims on this page.

  • Content-addressed receipts

    Every accepted clip is identified by the SHA-256 hash of its audio, so anyone holding the file can verify it here.

    SHA-256In development

  • Public ledger

    Receipts are published as they are issued. Withdrawals append an event; nothing is silently removed.

    Append-onlyIn development

  • Dataset manifests

    Each delivered dataset ships with a manifest listing the receipt of every clip inside it.

    Planned

  • Live posture

    Every number on this page is computed from the ledger at request time, never typed in.

    ComputedLive

What ECHO will collect

Every receipt declares what its file is. Identity and location never leave ECHO’s systems.

File specification

Delivery audio
WAV, 48 kHz, 24-bit, mono
Capture
Lossless on device, uploaded over TLS
Transcripts
UTF-8, verbatim and normalised
Metadata
JSON, one record per clip

Declared on every receipt

  • Language and locale
  • Task type and prompt ID
  • Duration
  • Recording environment
  • Device class
  • Self-described age band
  • Self-described accent
  • Licence version
  • Review outcome
  • Payout status

Never on a receipt

  • Name or contact details
  • Exact location or GPS
  • IP address
  • Device identifiers
  • Government ID data
  • Raw identity documents

Consent and policy versions

Each receipt will name the exact version a contributor agreed to. These are the versions published today, with the hash of their source so any change is detectable.

Security posture and subprocessors: Trust Center

Questions

Something we haven’t covered? Ask us and we’ll add it here.

Is ECHO GDPR compliant today?

ECHO is pre-launch and does not yet collect voice data. The contributor app is being built around GDPR's requirements: explicit per-purpose consent, access, export, deletion and EU data residency. We'll mark it Live here only when it's operating.

Is a voice recording biometric data?

It can be. Voice can identify a person, and laws like Illinois' BIPA treat voiceprints as biometric. ECHO collects written consent per task, never builds voiceprints for identification, and publishes its retention schedule.

How does a contributor withdraw consent?

In the app, at any time. Unlicensed clips are deleted. Licensed clips are removed from every future dataset delivery, and the receipt gains a withdrawal event so buyers can see it.

Why put receipts on a public page?

An audit trail only the seller can see isn't an audit trail. A public ledger lets contributors, customers and regulators check the same record on the same terms.

What's on a receipt, and what isn't?

The audio's hash, language, task, licence version, review outcome and payout status. Never identity, location, IP address or device identifiers. Those stay in ECHO's systems, and receipts carry only a pass/fail flag.

Can I see the recordings themselves?

Not through this page. Receipts prove provenance without exposing audio. Teams evaluating a dataset get access through a commercial agreement.