[Important] VoicePing 3.0 security improvements and Terms update

Update history

• October 29, 2026: Confirmed Python 3.13.18 production deployment and added PDF and network-library fixes, sharing-link and room-access controls, and device-history recovery safeguards.
• October 27, 2026: Reviewed recent changes across related repositories and added Python, Electron and Brotli findings, four officially supported processing and storage options, and protections for device history and diagnostics.
• October 24, 2026: Moved the update history to the start and streamlined the security updates, backend-refresh explanation, manual descriptions, and Terms and Privacy Policy highlights. Cover dates now match the article’s update date.
• October 23, 2026: Added the eMudhra/emSign response, Node.js, Go and Nginx update details, and further authentication, input and startup safeguards. Changed the header to “Security measures” and its localized equivalents, linking directly to each of the five article editions.
• October 22, 2026: Added data retention and deletion guidance, the PHP vulnerability assessment, MySQL and library-update examples, and English/Japanese questionnaires.
• October 20, 2026: Published the security notice and summary of changes to the Terms, Privacy Policy and billing disclosures.

Article summary

We updated our Terms of Service, Privacy Policy and billing disclosures on October 20, 2026. This is not a data-breach notice.

For VoicePing 3.0, we reviewed authentication, input and startup checks, dependencies, and certificate trust settings, then deployed updates in the environments covered.

Coverage varies by service and environment. These controls do not guarantee the security of every device or external service, or protection against future vulnerabilities. Use the security manuals for control scope, and the Terms of Service and Privacy Policy for contract and data-handling conditions.

Newly adopted and confirmed security updates

Our response to the eMudhra/emSign certificate issue

A problem was identified in private keys for intermediate certificates operated by the Indian certificate authority eMudhra under emSign. Mozilla’s October 20 announcement explains that these keys could be used to issue fraudulent HTTPS certificates and impersonate websites.

VoicePing also reviewed the trusted certificate authorities used to verify outbound connections. We updated affected Node.js environments to 24.22.1 and updated Python certificate trust, including Certifi 2026.10.19, to exclude emSign ECC Root CA - G3, the root above the affected intermediates. We checked the certificate bundles actually used by the services in scope and their operation after deployment.

A service may need this trust-store check even when its own website certificate comes from another issuer.

Python, Electron and compressed-data handling

Deployment and runtime verification of Python 3.13.18 are complete for the covered production speech-recognition, translation API and processing-worker environments. This includes rejection of the compromised intermediate certificates and fixes for XML parsing, tar extraction and temporary-file cleanup. The covered services also check the required interpreter version at startup.

The desktop build environment remains on Python 3.13.17; auxiliary tools and legacy environments are reviewed separately. We also check certificate bundles in existing virtual environments. This does not mean every Python environment has been upgraded.

Google’s Brotli compression library had a vulnerability that could corrupt memory when decompressing malformed data (CVE-2026-111497 ). The covered Node.js runtimes have been updated. For Electron 43.8.3, used by our desktop app, source inspection and functional tests confirmed that Chromium’s bundled Brotli includes the fix. We assess Electron’s embedded Node.js separately from build-tool Node.js, and have strengthened certificate verification and prevention of credential forwarding when the destination changes.

Further safeguards for authentication, input and startup

Our recent review across repositories also confirmed these changes beyond dependency updates:

• Prevent credential reuse: Password resets invalidate existing sessions as part of the same transaction, and verification limits apply to concurrent requests. SAML authentication rejects reused responses across processing workers.
• Protect sharing links and room access: Changing an account’s sharing URL or QR code requires workspace permission, sharing to be off, and the account owner’s confirmation. The change and audit record commit together. Guests cannot approve their own room admission or approve access across workspaces.
• Restrict accepted input: Reject inconsistent upload sources and destinations, unsafe paths and unexpected request fields. Bound the amount of audio and message data that can be processed.
• Restrict code execution during startup and updates: Parse configuration values as literal strings rather than shell commands. In the covered runtimes, verify files and dependencies against reviewed inventories before startup, and restore both service and certificate settings if activation fails.
• Protect diagnostics and private images: Remove credentials from new textual recording-worker diagnostics and recheck permissions when fetching private images. Additional cache controls prevent private images from reappearing for another user through persistent caches on shared devices.

These are examples of verified implementations and deployments. Coverage differs by control, and additional safeguards remain in development or testing.

Defenses implemented and improvements underway

We have implemented suspicious-access alerts, automatic IP blocking under defined detection rules, and tools to detect and investigate suspected account impersonation.

We are expanding detection and blocking coverage and developing measures to contain the impact of an intrusion.

Dependencies and runtimes updated

Recent reviews inventoried direct and indirect dependencies and checked npm advisory data , OSV , the Go Vulnerability Database and each maintainer’s security notices and release history. Updates followed artifact review and isolated tests, with checks after deployment.

Verified update examples:

• pypdf 6.21.2: Updated the covered production PDF processors to address excessive processing time caused by malformed references and oversized entry counts in PDFs. Release notes
• urllib3 2.8.0: Updated the covered R2 audio-archive process with fixes for HTTPS proxy certificate settings, infinite streaming loops and unbounded buffering. Maintainer changelog
• Samlify 2.15.1: Updated the SAML authentication library and tested signature verification and rejection of reused authentication responses. Maintainer advisory
• Nodemailer 10.1.7: Updated the email library and tested how recipient addresses are interpreted. Release notes
• pgx 5.11.0: Updated the PostgreSQL driver and tested malformed-input rejection, connections and queries. Release notes
• lib0 0.2.119: Updated data decoding and tested that reads stay within the supplied input bounds. Maintainer advisory
• Node.js 24.22.1: Updated certificate trust and incorporated fixes for TLS hostname verification, DNS handling and compressed-data decoding. Verified the running version and responses in the API environments covered.
• Go 1.27.3 / 1.26.10: Rebuilt and deployed services with the patched version of their respective Go release line, incorporating certificate-verification fixes. Reviewed and updated related HTTP/2, gRPC and other dependencies.
• Nginx 1.30.6: Applied security fixes covering memory handling and TLS sessions, then verified encrypted connections and normal operation.
• MySQL 8.4.11: Completed the upgrade and verified the running version and database connection.

These are verified update and deployment examples. Some dependencies use compatibility patches, and some tools are restricted to specific operations. Scan results do not establish that every dependency is free of vulnerabilities.

October 21 PHP vulnerabilities: no impact on VoicePing

VoicePing does not use PHP to run its service or public website, so it is not affected by these two vulnerabilities. Customers do not need to change their VoicePing settings.

On October 21, 2026, the PHP project disclosed two flaws that can let an unauthenticated attacker run code on a server using vulnerable PHP:

• CVE-2026-109618 — incomplete initialization: If memory runs out while PHP is preparing internal request data, cleanup can use data that was never fully initialized.
• CVE-2026-109619 — references to freed memory: Internal state from one request can remain after its memory is released. The same worker can then use that stale state while starting a later request.

These flaws affect PHP itself, including deployments using PHP-FPM or Apache’s PHP module. If your organization runs PHP for another system, check that system separately and follow the PHP project’s security advisory .

Four officially supported processing and storage options

Choose where data is processed and saved to suit your use case and organization’s rules. Online speech recognition and translation send data for processing even when cloud storage is disabled. Choose Offline Translation to process audio and text without sending that content to the cloud.

Device saving defaults to on when cloud saving is disabled. Turn device saving off as well if you do not want to retain records.

Online device history belongs to the host’s account and workspace and does not sync to other devices. Web and desktop clients save transcripts, translations and audio; mobile online storage saves transcripts and translations.

Offline Translation uses supported PC or mobile models and keeps saved text and audio on the device. Model downloads and sign-in still require a connection.

Recent fixes improve saving decisions during setting or account changes, delayed subtitle handling, and retries after failed deletion. Browser-data clearing or device failure can remove local history, so export records you need to keep.

PC and mobile clients now include explicit, user-confirmed recovery of older offline history. Desktop changes also preserve data after failed saves, support retries, and complete pending saves before normal quit or update installation. These fixes require an app version that includes them.

Disabling cloud saving does not delete earlier cloud history. Features that require storage, including file transcription and recording, are restricted. The Privacy Policy explains information needed for sign-in, billing and security operations.

Why we rebuilt the VoicePing 3.0 backend

Since VoicePing 2.0, we have regularly detected suspicious access consistent with automated vulnerability scans. This helped inform our decision to rebuild the backend for VoicePing 3.0.

We use advanced AI models to assist development and security review, alongside open-source penetration-testing tools. We test the service from inside and outside within a defined scope, and have implemented defenses against XSS, SQL injection and attempts to bypass permissions by altering request parameters.

Reviews, testing and fixes continue as new vulnerabilities and attacks emerge. This article is an overview of that work, not a penetration-test report.

Security manuals by area

Each manual explains the controls and scope for its area and identifies work still in testing or development. Detailed internal configurations, detection rules and limits remain private.

The application, infrastructure, operations and security-overview manuals are available in English and Japanese; the links below open the English editions. The data retention and deletion guide is available in all five article languages.

Application: identity, permissions and untrusted input

The application security guide explains how we verify identity and permission for an action. It covers account recovery, workspace and meeting-record permissions, guest invitations, API keys, OAuth/MCP access and worker authorization.

The command-injection section covers separating commands from input, validating arguments and restricting parser permissions. The file-validation section explains format, size, storage and parsing limits. Some additional controls are still in testing. Format validation is not an antivirus scan of every uploaded file.

Infrastructure: connections, detection and recovery

The infrastructure guide covers encrypted connections, public exposure, administrative access, backups and recovery. Its detection and request-limits section explains limits by IP address, user or feature, and detection across applications, servers and devices. Reaching a usage limit alone does not indicate abuse; blocking follows defined attack-detection rules in supported environments.

Endpoints and operations: monitoring and human review

The operations guide covers local and remote process monitoring, alerts, manual maintenance, and response to mistakes or suspected malware. It also describes screen recording under development for DaaS (remote desktop environments), including when recording stops, viewing permissions and privacy. These tools are not automatically installed on customer devices.

Libraries: dependency reviews and update sources

The supply-chain review section describes our policy for checking publishers, direct and indirect dependencies, artifacts, install scripts and AI model-loading code. We combine hashes, signatures and vulnerability checks, and continue reviewing existing dependencies. Coverage varies by service.

See the review sources and scope for further detail. The version examples above are updates whose deployment was confirmed.

Middleware: official advisories, updates and live verification

We assess updates using official Node.js , Nginx , Ubuntu and Go advisories alongside actual usage. The process covers artifact review, isolated testing, recovery preparation, deployment and checks on the running service.

The middleware update guide explains how official advisories, artifact review, isolated testing, recovery preparation and post-deployment checks fit together. See the version examples above .

Procurement: certification, data handling and the checklist

The security overview brings together ISO/IEC 27001 certification, data use and deletion, availability and support. The October 22 questionnaire retains all 143 questions and adds verified MySQL and library-update examples with their sources. Use it alongside the policies and contract that apply to your deployment.

English PDF · Japanese PDF

Terms of Service and Privacy Policy highlights

Security controls are separate from the contractual terms and data handling rules readers need to review. This section is an overview; the applicable plan, contract and legal conditions are defined in the linked documents.

Unauthorized access, reverse engineering and IP restrictions

Article 22 of the Terms prohibits conduct and attempts such as:

• Unauthorized reverse engineering or extraction intended to obtain or reproduce nonpublic internals, source code, model weights, system prompts or credentials, including through AI or automation tools.
• Bypassing authentication, permissions, billing, usage limits or other safeguards, or accessing data and features without authorization.
• Excessive or repeated access that harms security or availability, and evading restrictions through another account or connection source.

We do not permit service use from IP addresses reasonably identified through access records and other objective evidence as used for unauthorized access or attempts. We block those connections within a necessary and proportionate scope.

API and MCP use within published specifications, ordinary analysis of data you are authorized to access, and security testing we approve are outside these prohibitions. Using AI, a VPN or a shared network alone is not a violation. We review reports of mistaken restrictions, including shared or reassigned IP addresses, and remove or correct restrictions when an error is confirmed.

Refunds and settlement after termination for serious violations

Unnecessary charges caused by our system failures or bugs will be investigated and corrected, canceled or refunded. Refunds arising from our payment or cancellation defects carry no processing or handling fees. If payment failed and we received no money, we check the billing record and make any necessary correction.

Refunds for customer convenience are generally unavailable. If we voluntarily make an exception where no refund is owed, we may deduct actual unrecovered Stripe processing costs and a JPY 2,000 tax-inclusive handling fee, after advance itemized disclosure and agreement, within applicable legal and payment-service limits. Deductions cannot exceed the refund amount, and we do not bill a shortfall separately.

For a business customer whose contract is lawfully terminated for a serious violation, fees for the contractual one-month segment containing the termination date are nonrefundable under Article 13 . Prepayments for subsequent unprovided periods are returned after lawful settlement. Consumer contracts have separate settlement conditions under that article. Suspicion or a temporary restriction alone does not forfeit prepayments for unprovided services.

Data retention and deletion

Use the app’s delete controls for ordinary deletion. Retention for cloud-stored data depends on the data type. The main automatic cleanup thresholds are listed below. These cloud cleanup thresholds do not apply to history stored on your device.

These are cleanup thresholds, not promises of availability or instant erasure. Background processing, active jobs and retries can affect completion. Earlier deletion, plan settings and contract terms may apply.

Uploaded source videos follow a separate lifecycle. Delete the upload or job in File Transcribe to remove its source and generated files; deleting the transcript alone does not remove all of them. A file still used by another retained job is kept. Stopping a recording or cancelling processing does not delete saved results.

Deleting an ordinary transcript or meeting-room recording hides it first; permanent cleanup becomes due 30 days after the deletion action. Automatic expiry does not add another 30-day wait. Deleting a bot session requests removal of its audio and video, while its transcript follows a separate process. Video expiry alone can leave audio, text and summaries.

Cancelling a plan does not delete its data. Leaving a workspace or deleting your account does not erase all shared team records. Downloads, exports and copies sent to other services need separate deletion at their storage locations.

See the data retention and deletion guide for recording-file controls, account and workspace cleanup, offline history, dictionaries, voice registration, backups and logs.

Cancel, switch to Free or delete accounts within the app

For plans ordered and paid for in the app, the contracting customer or authorized administrator must complete ordinary cancellation, stopping automatic renewal and changing to Free through Billing. We do not accept or perform these ordinary operations by email, including replies to billing or notification messages. Procedures separately agreed in individual contracts continue to apply.

Ordinary workspace and account deletion must be completed in the app by you or an authorized administrator. We do not accept email or support-form requests to perform these routine operations for you. If you lack permission, ask your workspace owner or administrator. We intervene only when a confirmed failure or bug in our system prevents the prescribed deletion action. Report suspected defects with the affected data, attempted steps, time and error; we investigate and, after confirming the defect and verifying identity and authority, take the necessary action.

Uninstalling the app or removing a payment card does not cancel a paid plan. Check the subscription status and cancellation result after completing the procedure. Requests to erase personal information and valid personal-data deletion requests are handled separately under the Privacy Policy, rather than as ordinary app-operation assistance.

How we handle security records

IP addresses, access times, authentication outcomes, detection results, restrictions and appeal-handling records are used to detect, prevent and investigate unauthorized access. We limit this processing to the scope and period necessary for security, subject to the retention and deletion conditions in our Privacy Policy .

Review the revised documents

• Terms of Service
• Privacy Policy
• Commercial disclosures

This article summarizes the changes. Please consult the documents for the full conditions. If you suspect a defect or want a restriction reviewed, contact us through the support form .