Vokrae's security architecture ensures that sensitive information is protected at every level — from data collection to storage, authentication, and infrastructure.
Contents
Vokrae is architected so we cannot identify reporters. No IP logs, no personal data columns, no tracking. Security is structural.
Vokrae's architecture ensures complete reporter anonymity:
Anonymous ID Format
Each reporter receives an ID like HOPE-2847-STAR — randomly generated with no connection to their identity or device.
These IDs are hashed in the database and automatically redacted from system logs.
All admin sessions use secure JSON Web Tokens with automatic expiration.
Granular permissions based on user roles:
All rate limits are keyed by organization or chat ID — not by IP address — ensuring no IP data is stored:
| New conversations | 30 per hour |
| Messages per chat | 80 per 15 min |
| File uploads | 25 per 15 min |
| Passphrase attempts | 8 per 15 min |
Passphrase Brute-Force Protection
Only failed passphrase attempts count toward the limit. Legitimate reporters who enter the correct passphrase are never rate-limited. After 8 wrong guesses, the chat is locked out for 15 minutes.
Messages cannot be deleted once sent. This ensures:
When a reporter opts in, text is sent to Anthropic API to neutralize writing patterns while preserving meaning.
⚠️ Opt-in only — text is processed server-side via Anthropic when the user chooses to anonymize.
Server-side processing via ffmpeg. Audio files are processed and immediately deleted after anonymization.
No voice data persists on servers.
Client-side processing only — runs in the user's browser. No image or document data is sent to servers before anonymization.
Note: Hosting and CDN providers may process connection metadata (IP addresses, user agents) under their own policies. Vokrae's application code does not persist reporter IP addresses.
Vokrae uses Paystack for all payment processing:
All payment card data is handled exclusively by Paystack's secure infrastructure. Vokrae only stores payment reference IDs and transaction metadata.
| Reporters | Anonymous ID, message content, file metadata, timestamps, urgency flags |
| Organization Admins | Email, name, role, activity audit log (actions only, no IPs) |
| Super Admins | Email, audit log including IP (for platform security only) |
Vokrae uses the following services (all configurable):
We take security vulnerabilities seriously. If you discover a security issue, please report it responsibly:
Responsible Disclosure Process:
Scope
Please report vulnerabilities in Vokrae's application code and infrastructure. Issues with third-party services should be reported to those services directly.
Our security team is here to help.
Machine-Readable Security Data
For programmatic verification, security audits, or automated compliance checks, access our security information as JSON:
GET /api/trust/security