> ## Documentation Index
> Fetch the complete documentation index at: https://manual.voiceping.net/llms.txt
> Use this file to discover all available pages before exploring further.

# Application security

> Identity checks, endpoint authorization, separation between organizations, invitations, APIs and defenses against web attacks.

VoicePing checks who is making a request (authentication) and whether they may access the data or perform the action (authorization). Permissions are enforced on the server as well as in the interface.

**Updated October 21, 2026.** This guide covers selected controls. Internal API details, detection rules and limits are kept private. See the [security overview](/en/security) for our policy and questionnaire. [日本語版](/ja/security-application).

## Accounts, sign-in and recovery

Accounts are managed per user. Standard password registration includes email verification. Verification codes have expiry, attempt and resend limits to prevent reuse and repeated guessing.

Users can change passwords in [account settings](/en/account-settings), or use password recovery when they cannot sign in.

Reset links expire, serve a single purpose and can only be used once. Completing a reset invalidates existing sessions. Any outstanding identity checks or additional authentication are still required.

![Identity and membership checks before sign-in, and expiry and prior-use checks before resetting a password and revoking existing sessions](https://mintcdn.com/test-cf63e467/qnYfqo34_6fjxGqk/en/images/security/illustrated/02-account-recovery.webp?fit=max\&auto=format\&n=qnYfqo34_6fjxGqk\&q=85\&s=facb1ab9e366f4453707353b757f6d6f)

For SSO and Google or Apple sign-in, the server validates the received authentication information. Additional email verification or multifactor authentication depends on the sign-in method and organization settings. See [SSO configuration](/en/sso-entra-id).

When a member leaves or changes roles, administrators update [membership and roles](/en/member-management) and remove unnecessary access. They also review user-bound API keys, connected integrations and shared organization keys.

## Authorization by endpoint type

An endpoint is an API or connection that receives requests from an application or external system. Authentication and permission checks depend on its purpose.

| Type | Main checks | Examples of rejection or detection |
| - | - | - |
| Registration, sign-in and recovery | Verification codes and external identity information | Expired or reused credentials; repeated attempts |
| Member APIs | Session, current membership/role and permission for the requested data | Another organization's data; unauthorized administration |
| Invitations and guest access | Invitation validity, destination and any required password | Invalid links; access outside the permitted scope |
| External APIs and MCP | API-key or OAuth authorization and permitted operations | Insufficient scope, revoked connections or failure to meet configured source restrictions |
| Processing workers | Caller authentication and assignment to the job | Updating another worker's processing result |
| Realtime and meeting connections | Connection authentication, meeting participation and action checks | Unauthorized meeting access or operations |

![Requests pass authentication and authorization checks before the permitted operation; requests that fail either check are rejected](https://mintcdn.com/test-cf63e467/qnYfqo34_6fjxGqk/en/images/security/illustrated/20-endpoint-authorization.webp?fit=max\&auto=format\&n=qnYfqo34_6fjxGqk\&q=85\&s=a16b3210eb38ce6e243be95b69b8f512)

## Organization and data separation

Data is logically separated by workspace. Checks consider membership, role, ownership and visibility. Meetings, transcripts, summaries, invoices and time-tracking records each have their own access conditions.

Administrators must also have permission to access private data. Download links for recordings and attachments are issued only after checking access to the underlying resource.

![Membership, role and visibility checks allow access to authorized organization data and reject unauthorized access across organizations](https://mintcdn.com/test-cf63e467/qnYfqo34_6fjxGqk/en/images/security/illustrated/03-data-separation.webp?fit=max\&auto=format\&n=qnYfqo34_6fjxGqk\&q=85\&s=9002956b24ec59f7802b2fb478c123a9)

## Invitations, guests and meeting access

Invitations use hard-to-guess tokens. New invitation tokens are stored as hashes, have an expiry and are replaced when resent. Enterprise manual invitations also check the operator's permissions, email/domain and plan conditions.

Guests can join only the workspaces or meetings they are allowed to access. Media tokens are issued after checking participation rights, with publishing and receiving permissions set for the intended use.

![Validate the invitation and entry conditions, issue a media token with required permissions, then join the meeting](https://mintcdn.com/test-cf63e467/qnYfqo34_6fjxGqk/en/images/security/illustrated/04-invitation-media.webp?fit=max\&auto=format\&n=qnYfqo34_6fjxGqk\&q=85\&s=6d993eee15a5f47b8ad157d97469dcbe)

Rotating an invitation link and removing a guest who has already connected are separate actions. Revocation must consider both links and existing connections.

## APIs, AI tools and processing workers

The secret portion of an external API key is stored as a hash. Scopes define allowed operations, and configured source-IP conditions can restrict use. User-bound keys are distinguished from shared organization keys.

MCP integrations for AI tools use OAuth authorization and PKCE to protect authorization-code exchange. Operations check current membership and data permissions as well as scopes.

![API and MCP access checks scopes and data permissions; processing workers check caller identity and job assignment before updating results](https://mintcdn.com/test-cf63e467/qnYfqo34_6fjxGqk/en/images/security/illustrated/05-api-integration.webp?fit=max\&auto=format\&n=qnYfqo34_6fjxGqk\&q=85\&s=677b0467d33d19838248cfdce67905de)

Workers check their assigned job before updating a result. If workers share credentials, a credential leak may affect more than one worker.

## Defenses against web application attacks

We check input, permissions, processing and output. The table summarizes the main controls and review areas.

| Topic | Controls and review points |
| - | - |
| SQL injection | ORM and parameterized queries separate input values from SQL structure |
| Unsafe OS-command input | Executable instructions are separated from input data; argument, file and execution-permission checks are described below |
| Path traversal | Storage references and file permissions are checked to prevent arbitrary paths from exposing private files |
| External URL retrieval (SSRF) | Review destination and redirect restrictions to prevent unintended access to internal networks; coverage varies by feature |
| Sessions | Protected operations, expiry and revocation are managed; cookie protection is checked for each access path |
| XSS | Handle output safely and limit returned data, separately from transport encryption |
| CSRF | Check request origins where relevant, including cookie-authenticated requests, alongside correct HTTP-method handling |
| HTTP-header injection | Framework output APIs control response structure and header values |
| Clickjacking | Framing restrictions and authentication state are reviewed per page and delivery environment |
| File parsing and memory use | Selected parsers limit format, size, expansion and execution time; isolation scope varies by process |
| Dependency vulnerabilities | Compare actual usage with vulnerability information and review update artifacts |

![Validate input, check permissions, process safely and limit display, response and log output](https://mintcdn.com/test-cf63e467/qnYfqo34_6fjxGqk/en/images/security/illustrated/06-web-defenses.webp?fit=max\&auto=format\&n=qnYfqo34_6fjxGqk\&q=85\&s=a2dec8fea62014b4290ef24b3e7bf309)

## Command-injection defenses

Command injection occurs when input runs as an operating-system command. To prevent it, we **keep executable instructions separate from user-supplied data**.

![Check input types, ranges and permissions, separate executable instructions from data, and pass validated input to restricted processing](https://mintcdn.com/test-cf63e467/qnYfqo34_6fjxGqk/en/images/security/illustrated/21-command-execution.webp?fit=max\&auto=format\&n=qnYfqo34_6fjxGqk\&q=85\&s=2f70ebaa996fcde60cd13e9a7be6aa87)

| Area | Control examples |
| - | - |
| Starting an external program | Meeting and server-side parsing paths pass program names and argument arrays rather than executing shell strings assembled from user input |
| Administrative processes using a shell | Pass values separately to fixed scripts and check that they cannot become extra commands or unsafe options |
| AI and translation options | Selected APIs define accepted fields, types and numeric ranges, reject unknown fields and options that introduce executable behavior, and choose destinations/models from registered candidates |
| Parser permissions | SAML and collaborative-document parsing use separate processes with restrictions on networking, environment variables, writable locations, time, memory and output volume |

File names, paths, URLs and settings are also restricted to what the operation allows. Even with separate arguments, values must not introduce unsafe options, arbitrary destinations or external-file references.

Tests check that invalid values are rejected before execution while legitimate inputs, including Japanese file names, work. [Request limits and suspicious-request detection](/en/security-infrastructure#detection-and-request-limits-by-layer) add another layer of protection.

## File validation and parser boundaries

File validation checks the actual contents as well as the name and declared type. Media and document processing also restrict storage references and parsing methods.

![Validate file format, size and storage references, then restrict parser selection, external references and processing resources](https://mintcdn.com/test-cf63e467/qnYfqo34_6fjxGqk/en/images/security/illustrated/22-parser-boundaries.webp?fit=max\&auto=format\&n=qnYfqo34_6fjxGqk\&q=85\&s=1eca47b6e6e17a86a4b08279abfb42ad)

| Target | Examples |
| - | - |
| Subtitle uploads | Compare user/organization permissions, stored size and file-header format; revalidate retries and reject conflicting storage references |
| Media parsing | Select the reader for the confirmed format and restrict supported protocols and references to external resources |
| Supported Office documents | Limit expanded size and file counts; reject paths outside the storage area and XML definitions that reference external resources |
| SAML and collaborative data | Parse in an isolated environment with only the required read access. Failure to use isolation does not trigger a fallback to unrestricted processing |

Some additional upload controls are still in testing, and coverage varies by service as of October 21, 2026. Path, URL and configuration checks are also being expanded. Format validation is not an antivirus scan, and upload paths do not all use the same checks or isolation.

See [software supply-chain review](/en/security-operations#software-supply-chain-review) for controls addressing malicious code within packages or models themselves.

## Request limits and records

Request and volume limits depend on the IP address, user or feature. Sign-in, verification-code resends and guest access have specific controls. Reaching a limit does not by itself indicate abuse. See the [infrastructure guide](/en/security-infrastructure#detection-and-request-limits-by-layer) for detection and blocking.

Deletion checks ownership and storage locations so retries cannot delete another user's data. Logs retain what is needed for investigation while minimizing content and credentials. Hashed identifiers are still treated as potentially identifying information.

> [!TIP]
>
> If you have any questions, please contact us via [this form](https://voiceping.net/en/support/).

## Official Links

> **[Official Website](https://voiceping.net/)**
>
> Visit our official website

> **[X (Twitter)](https://x.com/VoicePingMedia)**
>
> Follow us on X

> **[Facebook](https://www.facebook.com/voiceping.inc)**
>
> Like us on Facebook

> **[LinkedIn](https://www.linkedin.com/company/28684130/)**
>
> Connect on LinkedIn


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.