Voice2Bug Security and Data Handling

1. What the extension may capture

During an issue reproduction session, Voice2Bug may capture:

• user actions and step order,
• visited URLs,
• manually captured screenshots of the visible area of the active tab,
• optional audio and transcription,
• operating system, architecture, browser, language, and screen resolution,
• console logs,
• metadata and selected headers from requests and selected network responses, plus redacted body snippets.

Voice2Bug does not use continuous screen video recording. Audio and screenshots are optional.

2. When collection starts

A user starts context collection in the extension while reproducing an issue. Audio is captured only when the user starts voice recording, and screenshots are captured only on request from the visible area of the active tab. The organization should define where the tool may be used and what data it may process.

3. Manual review and automatic delivery

In the manual report view, the user can edit or remove selected draft items, including the title, steps, and some evidence. A workspace administrator may instead enable automatic delivery to configured destinations. In that mode, a report may be sent after generation without separate approval in the report view.

Before a pilot, the administrator should review the destination settings and choose either manual or automatic delivery.

4. Filtering and redaction of technical data

The evidence policy limits the number and size of entries, filters out some irrelevant traffic, permits only selected headers, and attempts to redact recognized patterns such as secrets, tokens, email addresses, and selected data in URLs or bodies. Mutating requests and errors may still be retained as evidence when ordinary traffic is omitted.

Redaction reduces risk but does not guarantee that all sensitive data will be removed. Users should still avoid reproducing issues in production environments that contain secrets, personal data, or other sensitive information.

5. Where data may be stored

• Locally: chrome.storage and IndexedDB may store settings, session data, report drafts, and other working data.
• Redis on DigitalOcean: the job payload, including collected context and temporary audio.
• Supabase: authentication data; organization, license, and report records; and some file storage.
• DigitalOcean Spaces: some screenshots, rendered report HTML, and related assets.
• AWS: access provisioning, email messages, selected form data, logs, and report enrichment through Bedrock.
• Configured destinations: a Jira Cloud project or an email inbox may receive and retain delivered report data.

6. AI processing

OpenAI may receive audio for transcription; transcripts, user actions, URLs, and other text used to generate report content; screenshots for moderation; and, depending on the task, filtered report, console, or network data. AWS Bedrock may be used for enrichment, with OpenAI available as a fallback.

This page does not state that Zero Data Retention is active, that OpenAI processing occurs in a single region, or that all servers are located in Europe.

7. Protection in transit

Public Voice2Bug endpoints use HTTPS. HTTPS protects data while it is in transit; it does not determine how data is stored on a device, server, log, or recipient system. Voice2Bug does not describe reports as end-to-end encrypted.

8. Access to screenshots and assets

The backend includes mechanisms for private uploads and proxied access to report assets. However, behavior depends on rollout configuration, the report path, and a legacy fallback path. Therefore, this page does not claim that every existing screenshot is stored only as a private object.

Before testing with sensitive data, the organization should ask Voice2Bug to confirm the current configuration and run a controlled test of its own scenario.

9. How link access works

Sharing a report creates a random token. The URL token may be exchanged for a scoped HttpOnly cookie, and report assets may be served through a backend proxy. Anyone with an active link may use it to access the shared report, so share links only with intended recipients.

When a link expires or is revoked, access through its token is restricted, but the report and its assets are not automatically deleted.

10. Retention

• The Redis job payload has a lifetime of up to 24 hours.
• After successful report generation, audio is removed from the payload on a best-effort basis; after an error it may remain until the payload expires.
• Voice2Bug does not publish a single guaranteed automatic deletion date covering reports, assets, and every copy of form data because deletion mechanisms differ between data stores.
• Data delivered to Jira Cloud or an email inbox is also subject to the organization's retention policies and those of the destination provider.

11. Deleting a report or data

Deleting local data or revoking a shared link does not establish that every related record and copy has been deleted. To request broader deletion, email support@voice2bug.com. Voice2Bug handles the request manually after verifying the requester's identity or authority as an organization administrator.

Voice2Bug does not currently offer one-click deletion from every data store.

12. Providers and regions

The product's technical architecture may include Cloudflare, DigitalOcean, Supabase, Amazon Web Services, OpenAI, and Atlassian Jira Cloud. With website consent, the marketing site may also use Google Analytics and Microsoft Clarity. The administration panel may use Sentry for monitoring when configured.

These providers operate in different regions. In the repository, Bedrock defaults to eu-central-1, and the DigitalOcean Spaces endpoint contains a Frankfurt region identifier. Neither fact shows that every component or backup is in the EEA or that all support access occurs there.

13. Limitations and Organization responsibilities

• Voice2Bug does not replace a security audit, an extension approval process, or the organization's data classification process.
• Installing the extension and capturing or processing data may require IT or security approval.
• The organization should limit a pilot to authorized users and controlled, non-sensitive data.
• The administrator should review automatic delivery settings, email recipients, the Jira Cloud project, and link-sharing rules.
• Voice2Bug does not claim SOC 2, ISO 27001, HIPAA, or equivalent certification.

14. Security and data processing contact

Send questions about the architecture, current configuration, reporting a security issue, or data-processing terms for a pilot to support@voice2bug.com. Providing this contact address does not mean that a data processing agreement has been signed for a particular organization.

More information is available in the Privacy Policy.