Where data is stored
Answers, transcripts, and account data are stored in a managed database in Frankfurt, Germany, and recordings sit in private cloud storage reachable only through links that expire within the hour. Some processing happens elsewhere: the AI gateway runs in Stockholm, transcription runs in the United States with ElevenLabs, and Cloudflare handles traffic in transit from locations worldwide as voi’s DNS and content delivery provider. All AI models accessed through the AI gateway are exclusively hosted in the EU. Transfers outside the EU rely on Standard Contractual Clauses or the EU-US Data Privacy Framework, in line with GDPR requirements for international transfers.What protects the data technically
Data is encrypted in transit and at rest. Each workspace is isolated at the database level, so one organisation can’t reach another’s responses. Recordings are reachable only through links that expire within the hour. Technical identifiers such as IP addresses are stored as one-way hashes rather than in readable form, public endpoints are rate-limited against abuse, and the keys voi uses to reach its providers stay on the server and never reach a browser. An external security firm tests the platform, and every finding from its most recent test, in October 2026, has been fixed.Does voi use cookies?
voi sets no advertising or tracking cookies and uses no third-party analytics. The platform stores a small amount of information in your browser to keep you logged in, remember display preferences such as light or dark mode, and let an interrupted interview resume. A respondent’s browser holds one random identifier for the study link, which prevents duplicate submissions and expires within 48 hours.Sub-processors
The current sub-processor list is published at voi.leonardo-impact.com/legal/sub-processors, and forms part of the Data Processing Agreement you accept when you create a workspace. When a provider changes, workspace owners are notified by email and in the app within 30 days after the change takes effect, and a customer can object on data protection grounds within that period. See AI models & providers for the AI providers by name and what each is allowed to do, and contact [email protected] for the Data Processing Agreement itself.This section explains voi’s approach to data protection. It isn’t legal advice, and it doesn’t replace your organisation’s own privacy policy or the Data Processing Agreement you accept when you create a workspace.