Encryption and Data Encryption Key (DEK)
How transcription encryption works in VoxScriber: individual key per user (DEK) in all plans, two-layer key wrapping, and what happens when you change your password.
All your transcription content is encrypted with a DEK (Data Encryption Key) — an individual encryption key for your account. This applies to all plans, from Free to Enterprise: encryption isn't a paid feature; it's the default.
What is encrypted
- Text of the transcription;
- Speaker identification;
- Enriched data (summaries, AI metadata);
- Separately, CPF and phone number from the profile are encrypted at rest.
The algorithm is AES-256-GCM, applied before saving to the database.
How the key works (two-layer envelope)
Your 32-byte DEK is never stored in plaintext. It is "wrapped" in two ways:
- By your password, using Argon2id — only your password can open this wrapper;
- By a server master key (HKDF derivation) — this allows processing transcriptions in the background and recovering access if you forget your password.
Changed your password? The wrapper is redone immediately, without touching the content. Forgot your password? The reset revokes all sessions and redoes the wrapper from the server — you don't lose any encrypted transcription.
This design is a deliberate trade-off: a database dump alone is unreadable, but the platform can recover your access without erasing your content. Maximum protection against database leaks, without the risk of "I forgot my password, lost everything".
For enterprises: the key belongs to the organization
Transcriptions made in the context of an organization are encrypted with the company's DEK (derived on the server, with no individual password). Practical consequences:
- The content belongs to the company: anyone leaving the organization loses access, even if they are the author;
- An organization with active content cannot be deleted — deleting the key would destroy the content; it is deactivated.
If you've seen any material claiming encryption is exclusive to a higher-tier plan, ignore it: the individual DEK protects all plans. What changes between plans are features like engines, limits, and exports — never the security of the content.
Frequently Asked Questions
If the database leaks, do my transcriptions leak?
The content would be encrypted with AES-256-GCM and individual keys — unreadable without the keys. A scenario that compromises content would require the database AND the server to be compromised simultaneously.
Will I lose my transcriptions if I forget my password?
No. The password reset redoes the key wrapper from the server and preserves all the encrypted content.
Do I need to enable encryption somewhere?
No — it is automatic and mandatory for all transcription content, on any plan.
Is it end-to-end encryption (E2E)?
Not exactly: the server can decrypt to process (transcribe, summarize, export). It is encryption at rest with a per-user key — the database alone is unreadable, but the service works for you.
Who reads my company's transcriptions?
Inside the organization: owners and admins see everything; members see their own. Former members lose access. See the content rules in the organizations article.
Keep learning
- Data security and privacy - Retention and residency
- Recover password and access - Reset without losing content
- LGPD and GDPR - Data subject rights
- Delete my account - What happens to the data
Didn't find your answer? Open a ticket and we'll get back to you quickly.