/security
Security
A short page for a supplier or security review. Every fact here is also in the data processing addendum and on the organisations page. If this page and the addendum ever differ, the addendum is the binding text.
Who you deal with
AudioLaunch (KvK 54871204, Eindhoven, the Netherlands) runs AudioLab.tools. It is self-funded, without investors, and built by Nathan Renting. You contract with AudioLaunch under the terms, and Dutch law applies.
Where your audio goes
- In the browser labs, nowhere: the audio is analysed on your own device and sends us nothing.
- Through the hosted API or the MCP server, the audio is decoded and measured inside the request and is not kept. A compressed file passes through temporary scratch space that is deleted as soon as decoding is done.
- On the signed-upload route for larger files, the file lands in EU storage for a moment. A sweep that runs every fifteen minutes removes every upload older than 45 minutes, so it is gone within the hour, analysed or not.
- We do not use your audio or your results to improve the engine, to train models or for advertising, and we do not sell or share them.
Where it runs
The functions that measure audio run in the EU (Vercel, region fra1). The database, authentication and the upload bucket are in Frankfurt (Supabase, AWS eu-central-1). Both are US companies. The data sits and is processed in the EU, and for any access from the United States the EU-US Data Privacy Framework and the European Commission's standard contractual clauses apply. A new sub-processor is announced at least 30 days in advance.
How it is protected
- Everyone with access is bound to confidentiality.
- Connections run over TLS and the database is encrypted at rest.
- Tables are closed to clients by default (row level security without exceptions). Only the server API reaches them, and it checks on every request that the key or session belongs to the account.
- API keys are stored only as a hash, and you can revoke a key at any time.
- Uploads go to a bucket with a size limit, through one-shot signed links tied to your account.
- Error reports carry no audio and no file contents.
When something goes wrong
We report a personal data breach to you without undue delay and at the latest within 48 hours of discovering it. Security reports go to security@audiolab.tools and privacy questions to privacy@audiolab.tools. On request we give you the information you need to show that we meet the addendum, and we cooperate with an audit by an independent expert, after reasonable notice and at your cost.
Report a vulnerability
If you find a way to reach someone else's audio or account, or to break the service for other people, write to security@audiolab.tools (the same address is in security.txt). Say what you found, how to reproduce it and what you think it affects. We read every report.
Please do not access data that is not yours, do not run load or denial-of-service tests and do not use social engineering. We do not run a bug bounty. A number that looks wrong is not a security issue: write to hello@audiolab.tools instead.
What this page does not say
It describes how the service works, not a certification. For a security questionnaire, write to security@audiolab.tools. The measurements have their own honesty page: what we got wrong, and what we changed.
More
- Data processing addendum, with the sub-processors in section 5
- Privacy and cookies: what each part of the site stores
- For organisations: where your audio goes and what was checked
- Status