Trust isthe product.
A voice is personal. Here is every control we run or are building to protect the people behind ECHO, with its real status today.
- Live
- 7
- In development
- 13
- Planned
- 5
Contributor identity
Who can contribute, and how we know they are who they say.
Identity verification
PlannedGovernment ID matched to the contributor once, at onboarding, before any receipt is issued.
Liveness check
PlannedA short spoken challenge at the start of each session confirms a live person is recording.
Own voice only
In developmentContributors attest that every recording is their own voice. Duplicate and synthetic voices are screened before acceptance.
Anti-coercion limits
In developmentSession and daily limits, device checks and attestations make bulk or coerced recording impractical.
De-identification
In developmentIdentity never reaches a receipt or a dataset. Each contributor is an opaque speaker ID.
Consent and rights
What a contributor agrees to, and how that agreement is kept.
Per-task consent
In developmentEach task states its purpose, licence and pay before recording starts. Consent is captured per task, not once at sign-up.
Versioned licences
In developmentEvery receipt records the exact licence and policy version agreed to. Old versions stay published at their original hash.
Right to withdraw
In developmentIn the app, at any time. Unlicensed clips are deleted; licensed clips leave all future dataset deliveries. The receipt records the withdrawal.
Right to access and export
In developmentA full machine-readable export of everything held against a contributor's account.
Pay-through
In developmentEvery accepted clip is paid. Payment status is visible on each receipt.
Data handling
What is collected, what is kept, and what is never shared.
Pseudonymous datasets
In developmentDatasets carry a speaker ID and self-described attributes only. Never names, contact details or exact location.
Sensitive signals stay private
In developmentIP addresses, GPS, device identifiers and audio fingerprints never appear on receipts. Receipts record only whether a check passed.
Minimal website data
LiveForms collect only what is needed to reply. IP addresses are stored as keyed one-way hashes and purged within 24 hours.
No advertising use
LivePersonal data is never sold or used for advertising.
Retention schedule
LiveWaitlist data is deleted 24 months after last contact, or on request.
Data residency
PlannedEU contributors' audio stored in the EU; other regions stored in-region where required.
Security
How systems and data are protected.
Encryption in transit
LiveAll traffic served over TLS.
Abuse protection
LiveSigned form tokens, honeypot fields and per-connection rate limits on every form.
Encryption at rest
In developmentAudio and metadata encrypted at rest in production storage.
Least-privilege access
PlannedProduction access limited by role, logged and reviewed.
Vulnerability disclosure
LiveSecurity reports are accepted through the contact page and acknowledged by a person.
Audit and verification
How anyone can check the claims on this page.
Content-addressed receipts
In developmentEvery accepted clip is identified by the SHA-256 hash of its audio, so anyone holding the file can verify it here.
Public ledger
In developmentReceipts are published as they are issued. Withdrawals append an event; nothing is silently removed.
Dataset manifests
PlannedEach delivered dataset ships with a manifest listing the receipt of every clip inside it.
Live posture
LiveEvery number on this page is computed from the ledger at request time, never typed in.
Subprocessors
Named vendors will be listed here before any contributor data is collected.
| Category | Purpose | Status |
|---|---|---|
| Hosting provider | Website and application hosting | In development |
| Object storage | Encrypted audio storage | Planned |
| Email delivery | Waitlist and account email | Planned |
| Payments | Contributor payouts | Planned |
Published policies
Current versions, hashed so any change can be detected.
Found a vulnerability?
Report it
Use the contact form and choose “Privacy or data request”. Include steps to reproduce.
We acknowledge
A person replies to confirm we have it and are investigating.
We fix and credit
We tell you when it’s fixed and, if you’d like, credit you here.
Please don’t access other people’s data or degrade the service while testing.
Questions
Is ECHO GDPR compliant today?
ECHO is pre-launch and does not yet collect voice data. The contributor app is being built around GDPR's requirements: explicit per-purpose consent, access, export, deletion and EU data residency. We'll mark it Live here only when it's operating.
Is a voice recording biometric data?
It can be. Voice can identify a person, and laws like Illinois' BIPA treat voiceprints as biometric. ECHO collects written consent per task, never builds voiceprints for identification, and publishes its retention schedule.
How does a contributor withdraw consent?
In the app, at any time. Unlicensed clips are deleted. Licensed clips are removed from every future dataset delivery, and the receipt gains a withdrawal event so buyers can see it.
Why put receipts on a public page?
An audit trail only the seller can see isn't an audit trail. A public ledger lets contributors, customers and regulators check the same record on the same terms.
What's on a receipt, and what isn't?
The audio's hash, language, task, licence version, review outcome and payout status. Never identity, location, IP address or device identifiers. Those stay in ECHO's systems, and receipts carry only a pass/fail flag.
Can I see the recordings themselves?
Not through this page. Receipts prove provenance without exposing audio. Teams evaluating a dataset get access through a commercial agreement.