> ## Documentation Index
> Fetch the complete documentation index at: https://manual.voiceping.net/llms.txt
> Use this file to discover all available pages before exploring further.

# Infrastructure security

> System roles, encrypted connections, access restrictions, SSH, detection, backups and recovery.

VoicePing separates public connections, administrative access and data storage. Encryption, source restrictions and monitoring work together to protect these layers.

**Updated October 21, 2026.** This guide covers the main components and controls. Detailed connection settings, detection rules and limits are kept private. [日本語版](/ja/security-infrastructure).

## System architecture

Web, desktop and mobile apps connect to APIs, meeting communications, speech recognition and translation services. Content delivery, processing and storage use infrastructure suited to each role.

![Clients connect to content delivery and core services, which use databases, file storage and authorized external integrations](https://mintcdn.com/test-cf63e467/qnYfqo34_6fjxGqk/en/images/security/illustrated/07-system-architecture.webp?fit=max\&auto=format\&n=qnYfqo34_6fjxGqk\&q=85\&s=f09271ec997ea92a7340e738e7c9f0b4)

| Component | Role |
| - | - |
| Client applications | Web, desktop and mobile access to features |
| CDN and static hosting | Content delivery using services such as Cloudflare and Google Cloud |
| Public entry points and APIs | Receive connections through components such as load balancers and check authentication and permissions |
| Meeting and speech processing | Handle audio/video, transcription and translation |
| Databases and storage | Store different data types in databases and services such as AWS S3 |
| External integrations | Connect to AI processing, calendars and notifications within authorized scope |

The [Privacy Policy](/en/privacy-policy) describes the main cloud platforms and storage locations. Confirm the scope of dedicated or on-premises configurations individually.

## Encryption in transit

Web and API connections use HTTPS, realtime connections use WSS, and WebRTC audio/video uses protocols such as DTLS-SRTP. Encryption protocols and versions vary by connection type.

![Encrypted app and media connections lead to authorized server processing; transport encryption is distinct from end-to-end encryption](https://mintcdn.com/test-cf63e467/qnYfqo34_6fjxGqk/en/images/security/illustrated/08-encrypted-transport.webp?fit=max\&auto=format\&n=qnYfqo34_6fjxGqk\&q=85\&s=0cb0addff1affab65bc100c383bcb386)

Authorized servers process content for cloud transcription and translation. This is not end-to-end encryption that keeps content unreadable to the server. Internal connections and encryption at rest are reviewed for each configuration.

## Public exposure and administrative access

For services behind load balancers, source restrictions help prevent direct connections to backend servers from bypassing controls. Cloud rules, such as AWS security groups, are managed together with host settings.

Administrative SSH access uses public keys, which are reviewed regularly. When keys change or are revoked, we check that approved keys work and unwanted keys are rejected. Any hosts or settings we could not verify require follow-up checks.

![Public service access passes through approved entry points, while administrative access uses approved keys and sources; unauthorized connections are rejected](https://mintcdn.com/test-cf63e467/qnYfqo34_6fjxGqk/en/images/security/illustrated/09-network-access.webp?fit=max\&auto=format\&n=qnYfqo34_6fjxGqk\&q=85\&s=d97c32a1e789d3082232798012a11cc4)

TURN relays, used when a direct media connection is difficult, also have authentication, expiry and connection limits. Permission to join a meeting and permission to use the relay are checked separately.

## Detection and request limits by layer

Detection at public entry points, applications, servers and operational devices supports investigation and blocking.

| Layer | Detection or review examples | Response examples |
| - | - | - |
| Public entry point | Requests to attack-related paths, malformed requests and rapid repetition | Reject requests, limit frequency or block sources with strong attack indicators |
| Application | Invalid credentials, requests outside data permissions and excessive feature calls | Reject through authentication/authorization and record relevant events |
| Meeting and processing services | Participation mismatch, invalid relay credentials or updates to another worker's result | Reject connections or updates |
| Hosts and services | Stopped processes, abnormal responses, scheduled-task inconsistencies and certificate problems | Notify operators and compare settings with actual runtime state |
| Operational endpoints | Suspicious processes or changes to startup settings and access permissions | Notify in supported environments and have an operator review the details |

![Review signals from entry points, applications and endpoints, then distinguish request limiting from operator investigation](https://mintcdn.com/test-cf63e467/qnYfqo34_6fjxGqk/en/images/security/illustrated/10-detection-rate-limits.webp?fit=max\&auto=format\&n=qnYfqo34_6fjxGqk\&q=85\&s=77d1bcfe508d68c61eeb64f948df05b1)

**Rate limiting** caps requests within a time period. Limits depend on the IP address, user or feature, with specific controls for sign-in and account recovery. We also consider legitimate users who share an IP address.

Blocking and unblocking take account of attack indicators, shared IP addresses and previous exceptions. Reaching a usage limit or failing an access attempt does not by itself indicate abuse. Network-capacity attacks need separate controls alongside application rate limits.

Cloud monitoring includes approaches such as Amazon GuardDuty for threat detection and CloudWatch or custom service alerts. Coverage and settings vary by service.

## Backup, business continuity and recovery

Backup reviews cover the data included, frequency, location, retention and restoration procedures, according to the data type and contract. They also consider whether the required data can be recovered.

![One flow verifies restoration from backups; a separate flow manages application and configuration changes and rollback](https://mintcdn.com/test-cf63e467/qnYfqo34_6fjxGqk/en/images/security/illustrated/11-backup-recovery.webp?fit=max\&auto=format\&n=qnYfqo34_6fjxGqk\&q=85\&s=85e9d1fcaf5caf112ec979264357fd32)

| Topic | Review points |
| - | - |
| Backups | Database/file coverage, frequency, encryption, location, retention and deletion |
| Business continuity and disaster recovery | Continuity procedures and the scope of storage or failover across sites or regions |
| Data restoration | Recoverable points in time, procedure testing and recovery duration |
| Rollback | How configuration/application changes are reversed and how this affects data changes |
| Certificates and renewal | Expiry, renewal dry runs and connection checks after renewal |

Backup schedules, multiregion storage and recovery commitments depend on the current configuration and contract. Certificate checks cover both the validation endpoint and successful renewal.

> [!TIP]
>
> If you have any questions, please contact us via [this form](https://voiceping.net/en/support/).

## Official Links

> **[Official Website](https://voiceping.net/)**
>
> Visit our official website

> **[X (Twitter)](https://x.com/VoicePingMedia)**
>
> Follow us on X

> **[Facebook](https://www.facebook.com/voiceping.inc)**
>
> Like us on Facebook

> **[LinkedIn](https://www.linkedin.com/company/28684130/)**
>
> Connect on LinkedIn


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.