Data Security

Last updated: September 10, 2026

Security is built into how ElephantLabs handles every synthesis request — from your browser to our providers and back.

1. Encryption in transit

All traffic between your browser, our servers, and our speech providers travels over encrypted HTTPS connections. Unencrypted HTTP is never used for the speech API.

2. API keys stay server-side

Provider credentials (such as our OpenRouter API key) live only in server environment variables. They are never embedded in pages, JavaScript bundles, or client-side requests — your browser communicates exclusively with our own /api/speech endpoint.

3. No audio stored

  • Generated audio is streamed directly back to your browser.
  • Responses carry Cache-Control: no-store directives.
  • We keep no library of your texts or audio files on our servers.

4. Input validation and limits

  • Text input is capped at 2,000 characters per request.
  • Voice identifiers are checked against a strict allowlist.
  • Malformed requests are rejected before ever reaching providers.

5. Subprocessors

Synthesis requests are processed by:

  • OpenRouter — API gateway routing to speech models.
  • Deepgram (Flux TTS) — the text-to-speech model.

6. Reporting a vulnerability

Found a security issue? Please report it responsibly to koncoweb@gmail.com with details and reproduction steps. We will acknowledge receipt and work on a fix promptly.