Privacy & Sandboxing: How VoxCode Protects Your Code, Keys, and Prompts
Transparency in Open Beta: How VoxCode implements client-side encryption, ephemeral execution sandboxes, and zero retention for model training.
AI Executive Briefing & Key Takeaways
Machine-optimized summary for fast skimming or prompt injection
An honest look at VoxCode's security architecture: client-side encryption for BYOK keys, isolated in-browser Virtual File Systems, and a strict guarantee that user code is never used to train AI models.
01.An Honest Security Posture in Open Beta
Security should never be reduced to marketing buzzwords. While VoxCode is currently in Open Beta, we designed our architecture from day one around strict data isolation and privacy.
When you write code on your phone or desktop, your intellectual property belongs exclusively to you. Here is the exact technical reality of how we safeguard your code, API keys, and voice directives.
02.Zero AI Model Training Guarantee
The greatest concern for developers using AI-powered IDEs is having their proprietary software ingested into public training sets.
We hold zero-data-retention enterprise API agreements with upstream model providers. Your prompt instructions, code files, and audio streams are processed in transient inference memory and discarded immediately after completion.
Our Guarantee
Neither VoxCode nor upstream model providers retain or train on your source code or voice prompts. Ever.
03.Client-Side BYOK Encryption
If you choose to use our Bring Your Own Key (BYOK) feature with your own Anthropic, OpenAI, or Google API keys, your keys are encrypted client-side using Web Crypto AES-GCM before being stored in your browser's secure IndexedDB.
When making AI calls, the keys are passed through encrypted proxy headers directly to model endpoints without ever being logged in plaintext on our backend servers.
04.Ephemeral Sandboxing & VFS Isolation
Every preview session executes in an isolated in-memory Virtual File System (VFS). Code running inside your preview iframe cannot access host browser cookies, other project files, or local device storage.
05.Vulnerability Disclosure & Contact
We welcome independent security researchers to inspect our platform. If you discover any potential vulnerability during our Open Beta, please email us directly at security@voxcode.app with proof-of-concept details.
Sarah Lin
(Security & Infrastructure)Sarah focuses on application security, ephemeral sandbox isolation, and cryptographic credential management across Devaura services.
Built at Devaura Studio