Security
How NoiseScribe protects your audio, your account, and your connection.
Last updated 31 July 2026.
1. Everything runs over TLS
The whole site, the sign-in flow, and the live transcription connection are served over HTTPS. Traffic between your browser and NoiseScribe is encrypted in transit, and HTTP requests are redirected to HTTPS.
2. Your audio is relayed, never stored
Recorded audio is streamed through our server to the transcription provider and is never written to disk anywhere in that path. When a session ends there is nothing left to leak, because there was never a stored recording to begin with.
The transcription provider’s API key stays on our server and is never sent to your browser.
3. Sign-in and sessions
Sign-in uses Google’s OAuth with PKCE, so we never see or store a password. Your session is kept in a cookie that is HttpOnly (not readable by scripts), Secure (sent only over HTTPS), SameSite (not sent on cross-site requests), and signed so it cannot be forged or tampered with.
The live transcription connection checks your session before it is established — an unauthenticated connection is refused outright.
4. What we store
We store only your account record — your name, email and profile picture from Google. No audio, and no passwords. See the privacy policy for the detail.
5. This is a beta
NoiseScribe is in active development. It has not had an independent security audit, and we would rather tell you that than imply otherwise. Treat it accordingly for anything sensitive.
6. Reporting a problem
Found a security issue? Please tell us privately — email info@noisescribe.com, or use noisescribe.com/contact — before disclosing it publicly, and give us a reasonable chance to fix it. We read every report.