Report a Vulnerability
Voice2Jobs holds contractors' customer lists, quotes, invoices, and payment connections. If you have found a way to reach data or functionality you should not be able to reach, we want to hear about it, and we would rather hear it from you than from a customer.
Your Data, in Plain Words
Voice recordings are not kept
When you talk a quote into the app, the audio goes to our speech-to-text provider (Google), comes back as text, and is dropped. Voice2Jobs does not save the audio file, on our servers or on your device. What we keep is the quote you build from it. We do not use your recordings, quotes, or client details to train AI models.
Your quotes are yours
Rules in the database itself limit your quotes and invoices to your account and your team. A client sees a quote only through the private link you send, and an unsent draft does not open at all.
Encrypted on the way and at rest
Every connection is HTTPS, and browsers are told never to fall back to plain HTTP. Stored data is encrypted at rest. When a client pays by card, they type the number into Stripe's checkout page, so card numbers never pass through Voice2Jobs.
Delete the account, the data goes with it
Once any subscription is cancelled, deleting your account from settings erases your quotes, invoices, clients, documents, and uploaded files right away. If any step fails, the account stays intact so the deletion can be finished, never half done. Backups roll off within 90 days. On someone else's team, the work you did for that team stays with it. The exceptions are records the law makes us keep, such as tax records, and Enterprise Audit Vault records, which are kept for their 7-year period.
1. How to Report
Email security@voice2jobs.com. Please include:
- What the issue is, and what an attacker could do with it.
- Clear steps to reproduce it. A short recording or a request and response pair is ideal.
- The URL, endpoint, or screen involved, and roughly when you found it.
- Any account you used. If you needed a test account, say so and we will confirm it was yours.
Please report in English where you can, and please do not open a public issue, post publicly, or contact individual staff members before we have replied.
2. What We Commit To
- We acknowledge reports within 3 business days.
- We give you an initial assessment, including whether we consider it in scope and how severe we think it is, within 10 business days.
- We keep you updated while we work on a fix, and we tell you when it ships.
3. Safe Harbour
If you make a good-faith effort to follow this policy, we will not pursue legal action against you for your research, and we will not report you to law enforcement for it. If a third party brings action against you for research that followed this policy, we will make it known that your work was authorised.
Good faith means: you stopped as soon as you confirmed the issue, you did not access, download, alter, or retain anyone else's data beyond the minimum needed to demonstrate the problem, you did not degrade the service for anyone else, and you gave us a reasonable chance to fix it before telling anyone else.
4. Out of Scope
Please do not do any of the following. They put real customers at risk and they are not covered by the safe harbour above:
- Denial of service, load testing, or anything that degrades the service for others.
- Social engineering, phishing, or physical attempts against our staff, our customers, or our vendors.
- Accessing, modifying, or deleting data belonging to a real account that is not yours. Use your own test account.
- Testing systems we do not operate. Our payment processing, hosting, database, email, and AI providers each run their own disclosure programmes, and reports about their infrastructure should go to them.
We generally do not treat the following as vulnerabilities on their own, though we still read every report and will look again if you can show real impact:
- Missing security headers, or weak TLS configuration, with no demonstrated exploit.
- Output from an automated scanner with no analysis attached.
- Self-inflicted issues that require the victim to paste code into their own browser console.
- Email configuration findings such as SPF, DKIM, or DMARC records, absent a working spoofing demonstration.
- Rate limiting on endpoints that do not send messages, move money, or expose data.
5. Rewards
We do not currently run a paid bug bounty. We are a small team and we would rather promise a fast, honest response and public credit than advertise a reward we cannot administer consistently. If you report something serious, we will tell you so, fix it quickly, and say thank you properly.
6. If You Are a Customer
If you think your own account has been accessed by someone else, do not wait for this process. Change your password immediately, then write to security@voice2jobs.com and tell us what you saw. If you believe a person is misusing Voice2Jobs against you or your customers, rather than exploiting a flaw in it, that belongs under our Acceptable Use Policy.
7. Breach Notification
If a security incident affects personal data we process on a customer's behalf, we notify that customer without undue delay, as set out in our Data Processing Agreement. How we handle personal data generally is described in our Privacy Policy.