01
Least privilege
Access is a security consideration across the systems, information, and operations involved in our work. Permissions need to reflect legitimate responsibilities and operational requirements.
Security
Protecting the systems behind trusted AI.
Speech and language AI depends on more than capable models. Its security also involves the data, infrastructure, development processes, and applications behind those capabilities. At Sauti Labs, we consider security in the context of the systems we develop and the people and communities affected by them.
Our approach
Security is an engineering discipline.
02
Integrity and provenance
The origins and integrity of datasets, dependencies, code, and model artifacts matter throughout AI development. Traceability helps establish where resources come from and how they change.
03
Defense in depth
Security depends on the risks associated with a system and the combination of safeguards relevant to those risks. No single measure addresses every threat.
04
Continuous assessment
Security risks change with system capabilities, dependencies, exposure, and use. Our approach considers those changing conditions rather than treating security as a one-time decision.
Scope
What security covers.
Our security approach covers the resources involved in AI research and development, the systems that support our work, and the people and communities who may be affected by security failures.
01
Data and datasets
Audio recordings, transcripts, metadata, language resources, and research datasets used in speech and language AI.
02
Models and training
Training pipelines, model artifacts, configurations, evaluation resources, dependencies, and AI development workflows.
03
Infrastructure
Computing environments, storage, development tools, deployment systems, internal services, and supporting resources.
04
Applications and APIs
Web applications, service endpoints, integrations, and interfaces through which users and other systems interact with AI capabilities.
05
Identity and credentials
Accounts, service identities, access permissions, API keys, tokens, and other credentials that enable access to systems.
06
Voice and AI capabilities
Speech processing, voice generation, and related capabilities that raise questions about unauthorized access, impersonation, and misuse.
From data to deployment
Security across the AI lifecycle.
Security considerations span the lifecycle of AI systems. The relevant risks vary from data collection and preparation to training, evaluation, deployment, and maintenance.
STAGE 01
Collection
Data sources, permissions, provenance, sensitivity, and access requirements shape the security considerations surrounding collected resources.
STAGE 02
Preparation
Input validation, data integrity, sensitive information, transformations, and processing boundaries are relevant to preparing research resources.
STAGE 03
Training
Training security involves the environments, credentials, dependencies, datasets, and pipeline changes used to develop AI models.
STAGE 04
Evaluation
Evaluation involves protecting research resources and examining weaknesses, unexpected behavior, and security-relevant model outcomes.
STAGE 05
Deployment
Access control, configuration, model integrity, service exposure, and resilience inform the security assessment of deployed systems.
STAGE 06
Monitoring
Security signals, reported concerns, changing exposure, and newly identified risks inform the ongoing assessment of systems.
Areas of focus
Our security commitments.
Our security approach focuses on the risks associated with data, models, infrastructure, applications, and voice capabilities. Relevant safeguards depend on each system's design, maturity, exposure, and potential impact.
01Data and dataset securityUnderstanding the provenance, sensitivity, permissions, and integrity of speech and language resources.
- Dataset sources, permissions, provenance, and usage restrictions are central considerations when assessing speech and language resources.
- Raw audio, transcripts, metadata, and restricted research resources can have different sensitivity levels and access requirements.
- Data security includes the risks of unauthorized access, accidental disclosure, improper modification, and unnecessary retention.
- Dataset versions and transformations are relevant to understanding the origins of a resource and the changes made to it.
02Model and training-pipeline securityExamining the integrity of training inputs, development environments, dependencies, and model artifacts.
- Training-pipeline security involves credential handling, access restrictions, and changes to development workflows.
- The provenance of datasets, pretrained models, dependencies, and model artifacts helps inform assessments of development risks.
- Model versions, configurations, and release decisions are relevant to traceability and the integrity of AI development.
- External components and changes to training or inference workflows introduce security considerations that depend on their role and exposure.
03Infrastructure and access controlAssessing access, credentials, environments, and the systems that support research and development.
- Role, responsibility, and operational need are important considerations when determining appropriate system access.
- Credential security includes avoiding the exposure of secrets in source code and public repositories.
- The separation of development, testing, and production environments depends on the architecture and risks of the system.
- Changes in responsibilities, unnecessary permissions, and identified security concerns are relevant to access reviews.
04Application and API securityConsidering unauthorized access, abuse, configuration weaknesses, and software vulnerabilities.
- Application and API security includes input validation, authentication, and authorization appropriate to each service.
- Review and testing are important considerations for changes that affect security-sensitive behavior.
- Dependencies and system configurations can introduce known vulnerabilities that require assessment.
- For services exposed to users or external systems, safeguards such as rate limits, usage controls, and abuse detection are evaluated according to the risks involved.
05Voice integrity and misuse preventionRecognizing security risks associated with synthetic speech, speaker-related resources, and voice technologies.
- Voice recordings and speaker-related resources can contain identifying or sensitive information, making their access and handling important security considerations.
- Voice generation and cloning introduce risks that include unauthorized use, impersonation, fraud, and other foreseeable misuse.
- The relevance of access controls, usage restrictions, monitoring, and other safeguards depends on each system's capabilities and exposure.
- Generated-audio provenance and disclosure mechanisms are relevant considerations when assessing synthetic-speech risks.
06Security testing and vulnerability managementExamining weaknesses, understanding their significance, and identifying appropriate corrective action.
- Security testing is most relevant when it reflects the system's architecture, exposure, and potential impact.
- Security assessments can cover code, dependencies, configuration, access controls, and threats specific to AI systems.
- The severity, potential impact, and exposure of an identified issue help determine its significance.
- Identified weaknesses require assessment and appropriate corrective action based on their significance and context.
07Incident response and responsible disclosureAssessing security concerns and reducing harm when vulnerabilities or suspected incidents are reported.
- The potential impact and the systems or people affected are central to assessing a reported security concern.
- Incident-response considerations include containment, investigation, recovery, documentation, and reducing further harm.
- Relevant notification obligations and affected parties are considered when applicable.
- Responsible vulnerability disclosure provides a way to report potential issues while minimizing unnecessary access, exposure, and disruption.
Security for AI
Speech and language AI brings distinct risks.
Voice and language technologies introduce considerations that extend beyond conventional software security. Audio can contain identifying information, while speech-generation capabilities can be misused for impersonation, fraud, and other forms of abuse.
Our security considerations include who can access speaker-related resources, how datasets and model artifacts are handled, and which safeguards are relevant to a particular capability. The assessment depends on the technology involved and the potential consequences of misuse.
Speech recognition, voice generation, and related AI capabilities present different risk profiles. Security decisions need to reflect those differences rather than assume that one safeguard addresses every threat.
Responsible disclosure
Help identify security issues.
Responsible vulnerability reporting helps identify potential weaknesses and reduce the risk of harm. If you believe you have found a security issue affecting a Sauti Labs system, report it through an official Sauti Labs contact channel and clearly identify it as a security concern.
Include enough information to help us understand the reported issue, where it is safe to do so. Avoid accessing, modifying, or disclosing other people's information. Do not disrupt services or test beyond what is necessary to establish the potential vulnerability.
A dedicated security reporting address and formal disclosure procedure are not currently listed on this page. Reports can be directed through an official Sauti Labs contact channel and identified clearly as security concerns.